6.5
CVSSv3

CVE-2016-8629

Published: 12/03/2018 Updated: 09/10/2019
CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8
CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8
VMScore: 490
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P

Vulnerability Summary

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Vulnerable Product Search on Vulmon Subscribe to Product

redhat keycloak

redhat single_sign_on 7.1

redhat single_sign_on 7.2

Vendor Advisories

Synopsis Moderate: Red Hat Single Sign-On 71 update Type/Severity Security Advisory: Moderate Topic Red Hat Single Sign-On 71 is now available for download from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System ...
Synopsis Moderate: Red Hat Single Sign-On 71 update on RHEL 6 Type/Severity Security Advisory: Moderate Topic Red Hat Single Sign-On 71 is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sys ...
Synopsis Moderate: Red Hat Single Sign-On 71 update on RHEL 7 Type/Severity Security Advisory: Moderate Topic Red Hat Single Sign-On 71 is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sys ...
It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the rest server An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm ...