En bref
- CVE-2020-10686 est une vulnérabilité MOYENNE (CVSS 4.7) touchant org.keycloak:keycloak-core, keycloak (redhat).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.65%, plus élevée que 51.3% des vulnérabilités.
- Correctif : mettre à jour vers 9.0.2 ou plus récent.
Description
A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.
NVD description
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.
Autres vulnérabilités de org.keycloak:keycloak-core
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free