Improper Authentication in Keycloak - CVE-2020-1718
Published: May 13, 2020
Vulnerability identifier: #VU27879
CSH Severity: Medium
CVSS v4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1718
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in the reset credential flow. A remote authenticated attacker can bypass authentication process and gain unauthorized access to the application.
Affected software
Keycloak
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
How to mitigate CVE-2020-1718
Install updates from vendor's website.
Keycloak - update to 8.0.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0