GHSA-fv4q-wm8c-wjg4 CVE-2019-14909
Keycloak Authentication Error
- Severity
- 8.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.08%
- Chance of exploitation in the next 30 days. Higher than 65.01% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
- None yet
- No fixed version published
Description
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-parent | >= 7.0.0, <= 7.0.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 8.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CWE-305: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fwhw-chw4-gh37 Keycloak Server-Side Request Forgery (SSRF) vulnerability | Low | Also affects org.keycloak:keycloak-parent |
| GHSA-gv94-wp4h-vv8p Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-9hhc-pj4w-w5rv Keycloak Cross-site Scripting on OpenID connect login service | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-g8q8-fggx-9r3q Keycloak vulnerable to path traversal via double URL encoding | Critical | Also affects org.keycloak:keycloak-parent |
| GHSA-97g8-xfvw-q4hg Keycloak vulnerable to session takeover with OIDC offline refreshtokens | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-w9mf-83w3-fv49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-wf7g-7h6h-678v Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console | High | Also affects org.keycloak:keycloak-parent |
| GHSA-xv7h-95r7-595j Incorrect implementation of lockout feature in Keycloak | High | Also affects org.keycloak:keycloak-parent |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor