Security restrictions bypass in Keycloak - CVE-2016-8629
Published: March 16, 2018
Vulnerability identifier: #VU11133
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-8629
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Keycloak
Affected software:
Keycloak
Keycloak
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to bypass security restrictions on the target system.
The weakness exists due to improper permission checks when handling service account user deletion requests. A remote attacker can send a service account user deletion request, bypass permission checks and perform unauthorized actions, such as deleting other user accounts.
The weakness exists due to improper permission checks when handling service account user deletion requests. A remote attacker can send a service account user deletion request, bypass permission checks and perform unauthorized actions, such as deleting other user accounts.
How to mitigate CVE-2016-8629
Update to version 2.4.0.