436
VMScore

CVE-2020-27826

Published: 28/05/2021 Updated: 04/06/2021
CVSS v2 Base Score: 4.9 | Impact Score: 4.9 | Exploitability Score: 6.8
CVSS v3 Base Score: 4.2 | Impact Score: 2.5 | Exploitability Score: 1.6
VMScore: 436
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

Vulnerability Summary

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an malicious user to change its own NameID attribute to impersonate the admin user for any particular application.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

redhat keycloak

redhat single sign-on -

redhat single sign-on 7.4

redhat single sign-on 7.4.4

Vendor Advisories

Synopsis Low: Red Hat Single Sign-On 744 security update on RHEL 7 Type/Severity Security Advisory: Low Topic New Red Hat Single Sign-On 744 packages are now available for Red Hat Enterprise Linux 7 Description Red Hat Single Sign-On 74 is a standalone server, based on the Keycloak pr ...
Synopsis Low: Red Hat Single Sign-On 744 security update on RHEL 6 Type/Severity Security Advisory: Low Topic New Red Hat Single Sign-On 744 packages are now available for Red Hat Enterprise Linux 6 Description Red Hat Single Sign-On 74 is a standalone server, based on the Keycloak pr ...
Synopsis Low: Red Hat Single Sign-On 744 security update on RHEL 8 Type/Severity Security Advisory: Low Topic New Red Hat Single Sign-On 744 packages are now available for Red Hat Enterprise Linux 8 Description Red Hat Single Sign-On 74 is a standalone server, based on the Keycloak pr ...
Synopsis Important: Red Hat Single Sign-On 744 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 74 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
A flaw was found in keycloak versions prior to 1200 where it is possible to update the user's meta-data attributes using Account REST API It is now possible for any evil user to change its own NameID attribute to impersonate the admin user for any particular application ...