GHSA-7m27-3587-83xf

ghsaUSosv

Privilege Defined With Unsafe Actions in Keycloak

view advisory published 2021-10-21Licence: CC-BY-4.0

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10170US	high7.2	1.15% (67th)	—	2020-05-08
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10170WEB
https://github.com/keycloak/keycloakPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2019-10170ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan