CVE-2020-14302
published 2020-12-15CVE-2020-14302: A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts…
PriorityP426medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.99%
58.7th percentile
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | keycloak | < 13.0.0 | 13.0.0 |
| redhat | keycloak | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks
vendor_redhat·2020-11-26·CVSS 4.9
CVE-2020-14302 [MEDIUM] CWE-294 keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks
keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.
A flaw was found in Keycloak, where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.
Package: keycloak (Red Hat Decision Manager 7) - Not affected
Package: keycloak (Red Hat Fuse 7) - Not affected
Package: keycloak (Red Hat
GHSA
GHSA-74gp-x82w-5v28: A flaw was found in Keycloak before 13
ghsa_unreviewed·2022-05-24
CVE-2020-14302 [MEDIUM] CWE-294 GHSA-74gp-x82w-5v28: A flaw was found in Keycloak before 13
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.
No detection rules found.
No public exploits indexed.
2020-12-15
Published