CVE-2023-0264
Keycloak vulnerable to user impersonation via stolen UUID code
Résumé
Keycloak vulnerable to user impersonation via stolen UUID code
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.keycloak:keycloak-services
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.1"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web access.redhat.com