CVE-2019-14832
published 2019-10-15CVE-2019-14832: A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated…
PriorityP343high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.54%
41.8th percentile
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keycloak | keycloak_rest_api | — | — |
| keycloak | keycloak_rest_api | — | — |
| redhat | keycloak | < 7.0.1 | 7.0.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.0MEDIUMCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak Unauthenticated Access
ghsa·2022-05-24
CVE-2019-14832 [HIGH] CWE-863 Keycloak Unauthenticated Access
Keycloak Unauthenticated Access
A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
OSV
Keycloak Unauthenticated Access
osv·2022-05-24
CVE-2019-14832 [HIGH] Keycloak Unauthenticated Access
Keycloak Unauthenticated Access
A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
Red Hat
keycloak: cross-realm user access auth bypass
vendor_redhat·2019-10-14·CVSS 7.5
CVE-2019-14832 [HIGH] CWE-863 keycloak: cross-realm user access auth bypass
keycloak: cross-realm user access auth bypass
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
Package: keycloak (Red Hat Fuse 7) - Will not fix
Package: keycloak (Red Hat Mobile Application Platform 4) - Out of support scope
Package: keycloak (Red Hat OpenShift Application Runtimes) - Out of support s
No detection rules found.
No public exploits indexed.
2019-10-15
Published