Moderate severity vulnerability that affects org.keycloak:keycloak-core
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-8629US | medium6.5 | — | ||
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service acc… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2017-0876.htmlWEB
- http://www.securityfocus.com/bid/97392WEB
- http://www.securitytracker.com/id/1038180WEB
- https://access.redhat.com/errata/RHSA-2017:0872WEB
- https://access.redhat.com/errata/RHSA-2017:0873WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1388988WEB
- https://github.com/advisories/GHSA-778x-2mqv-w6xwADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2016-8629ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan