CVE-2019-10201
published 2019-08-14CVE-2019-10201: It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and…
PriorityP341high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.71%
49.5th percentile
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | keycloak | — | — |
| redhat | keycloak | <= 6.0.1 | — |
| redhat | single_sign-on | — | — |
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Verification of Cryptographic Signature in keycloak
osv·2019-09-23
CVE-2019-10201 [MEDIUM] Improper Verification of Cryptographic Signature in keycloak
Improper Verification of Cryptographic Signature in keycloak
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
GHSA
Improper Verification of Cryptographic Signature in keycloak
ghsa·2019-09-23
CVE-2019-10201 [MEDIUM] CWE-347 Improper Verification of Cryptographic Signature in keycloak
Improper Verification of Cryptographic Signature in keycloak
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Red Hat
keycloak: SAML broker does not check existence of signature on document allowing any user impersonation
vendor_redhat·2019-08-13·CVSS 8.1
CVE-2019-10201 [HIGH] CWE-287 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation
keycloak: SAML broker does not check existence of signature on document allowing any user impersonation
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Mitigation: Administrator can preven
No detection rules found.
No public exploits indexed.
2019-08-14
Published