GHSA-9g98-5mj6-f9mv CVE-2023-0264
Keycloak vulnerable to user impersonation via stolen UUID code
- Severity
- 8.7 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.27%
- Chance of exploitation in the next 30 days. Higher than 69.91% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
21.0.1- Upgrade org.keycloak:keycloak-services to this version or later
Description
Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-services | < 21.0.1 |
21.0.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.keycloak:keycloak-services Maven → 21.0.1
- maven
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>21.0.1</version></dependency>- gradle
implementation("org.keycloak:keycloak-services:21.0.1")
Severity breakdown
CVSS 3.1 8.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-v3f7-2p4r-mwfw Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass | High | Also affects org.keycloak:keycloak-services |
| GHSA-9jrw-8xf7-xqhq Keycloak vulnerable to information disclosure through arbitrary filesystem path probing | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-f5p5-6xmx-p252 Keycloak vulnerable to authorization bypass via incorrect uri comparison | High | Also affects org.keycloak:keycloak-services |
| GHSA-r7rc-c989-86g6 Keycloak: Attacker can re-enable and take over disabled clients via registration access token | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass | Critical | Also affects org.keycloak:keycloak-services |
| GHSA-6g26-7cx5-mrrg Keycloak: Information disclosure due to user profile permission bypass | Low | Also affects org.keycloak:keycloak-services |
| GHSA-cpf7-j4cf-vqx4 Keycloak has an Out-of-bounds Read | Medium | Also affects org.keycloak:keycloak-services |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor