What is GHSA-pf38-cw3p-22q9?

GHSA-pf38-cw3p-22q9 is a security advisory published by GitHub Security Advisories with Medium severity. Keycloak is vulnerable to IDN homograph attack

Which CVE IDs does GHSA-pf38-cw3p-22q9 cover?

GHSA-pf38-cw3p-22q9 covers the following CVE IDs: CVE-2021-3424. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pf38-cw3p-22q9?

GHSA-pf38-cw3p-22q9 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-pf38-cw3p-22q9?

GHSA-pf38-cw3p-22q9 affects 1 product, including: maven/org.keycloak:keycloak-services:\u003c 18.0.0.

GHSA-pf38-cw3p-22q9MediumCVSS 5.3

Keycloak is vulnerable to IDN homograph attack

Vendor

GitHub Security Advisories

Published

April 28, 2022

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2021-3424 →

📋 Description

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.

🎯 Affected products1

maven/org.keycloak:keycloak-services:< 18.0.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-3424
https://bugzilla.redhat.com/show_bug.cgi?id=1933320
https://github.com/advisories/GHSA-pf38-cw3p-22q9