What is GHSA-8prc-58j4-m55q?

GHSA-8prc-58j4-m55q is a security advisory published by GitHub Security Advisories with High severity. Keycloak Unauthenticated Access

Which CVE IDs does GHSA-8prc-58j4-m55q cover?

GHSA-8prc-58j4-m55q covers the following CVE IDs: CVE-2019-14832. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8prc-58j4-m55q?

GHSA-8prc-58j4-m55q has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8prc-58j4-m55q?

GHSA-8prc-58j4-m55q affects 2 products, including: maven/org.keycloak:keycloak-model-infinispan:\u003c 7.0.1; maven/org.keycloak:keycloak-model-jpa:\u003c 7.0.1.

GHSA-8prc-58j4-m55qHighCVSS 7.5

Keycloak Unauthenticated Access

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

August 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-14832 →

📋 Description

A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

🎯 Affected products2

maven/org.keycloak:keycloak-model-infinispan:< 7.0.1
maven/org.keycloak:keycloak-model-jpa:< 7.0.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-14832
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14832
https://github.com/keycloak/keycloak/commit/0b73685ccf3181115ae3936a578708630215ac23
https://github.com/advisories/GHSA-8prc-58j4-m55q