Security restrictions bypass in Keycloak - CVE-2020-27826

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU49112

Security restrictions bypass in Keycloak - CVE-2020-27826

Published: December 21, 2020 / Updated: December 22, 2020


Vulnerability identifier: #VU49112
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-27826
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists within the REST API functionality. Remote users can change their attributes, such as NameID and impersonate administrative users of the application.


Affected software

Keycloak
Red Hat Single Sign-On

How to mitigate CVE-2020-27826

Install updates from vendor's website.

Keycloak - update to 12.0.0
Red Hat Single Sign-On - update to 7.4.4

External References

Related Security Bulletins