CVE-2016-8629

EPSS 0.21%

Moderate severity vulnerability that affects org.keycloak:keycloak-core

發布日:2018/10/18修改日:2024/12/2

描述

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

受影響套件(1)

Maven/org.keycloak:keycloak-corefrom 0, < 2.4.0

參考連結(8)

ADVISORYhttps://github.com/advisories/GHSA-778x-2mqv-w6xw
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-8629
WEBhttp://rhn.redhat.com/errata/RHSA-2017-0876.html
WEBhttps://access.redhat.com/errata/RHSA-2017:0872
WEBhttps://access.redhat.com/errata/RHSA-2017:0873
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=1388988
WEBhttp://www.securityfocus.com/bid/97392
WEBhttp://www.securitytracker.com/id/1038180