CVE-2023-4918
Keycloak vulnerable to Plaintext Storage of User Password
8.8
HIGH
CVSS 3.1
EPSS 0.47%
描述
A flaw was discovered in Keycloak Core package. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular attributes in the users attributes. The password is also created, but the user attributes must not be there. This way, any entities (all users and clients with proper rights/roles) are able to retrieve the users passwords in clear-text. ### Impact Passwords for self-registered users are stored as cleartext attributes associated with the user. ### Mitigation Disable self-registration for users in all realms until patched.
如何修補 CVE-2023-4918
要修補 CVE-2023-4918,請將受影響套件升級到下列已修補版本。
- —升級至 22.0.3 或更新版本
CVE-2023-4918 正在被利用嗎?
低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 22.0.2, < 22.0.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |