En bref
- CVE-2020-35509 est une vulnérabilité MOYENNE (CVSS 5.4) touchant org.keycloak:keycloak-core, keycloak (redhat).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.35%, plus élevée que 28.8% des vulnérabilités.
- Correctif : mettre à jour vers 14.0.0 ou plus récent.
Description
keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.
NVD description
A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
Autres vulnérabilités de org.keycloak:keycloak-core
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free