Improper authorization in Keycloak
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-1466US | medium6.5OT elevated | — | ||
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the mast… | ||||
02
references
External citations — patches, advisories, analysis.
- https://bugzilla.redhat.com/show_bug.cgi?id=2050228WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2022-1466ADVISORY
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-076.txtWEB
- https://www.syss.de/pentest-blog/fehlerhafte-autorisierung-bei-red-hat-single-sign-on-750ga-syss-2021-076WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan