A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1905089 | Issue Tracking Vendor Advisory |
Configurations
History
04 Jun 2021, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1905089 - Issue Tracking, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.9
v3 : 4.2 |
02 Jun 2021, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1905089 - Issue Tracking, Third Party Advisory | |
| CPE | cpe:2.3:a:redhat:single_sign-on:7.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:7.4.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* |
28 May 2021, 11:37
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-250 |
28 May 2021, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-28 11:15
Updated : 2023-12-10 13:55
NVD link : CVE-2020-27826
Mitre link : CVE-2020-27826
CVE.ORG link : CVE-2020-27826
JSON object : View
Products Affected
redhat
- single_sign-on
- keycloak
CWE
CWE-250
Execution with Unnecessary Privileges