CVE-2020-1744
published 2020-03-24CVE-2020-1744: A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login…
PriorityP427medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
EPSS
1.09%
61.8th percentile
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | keycloak | — | — |
| redhat | keycloak | < 9.0.1 | 9.0.1 |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP
vendor_redhat·2020-03-23·CVSS 5.6
CVE-2020-1744 [MEDIUM] CWE-755 keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP
keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Package: keycloak (Red Hat Fuse 7) - Not affected
Package: keycloak (Red Hat OpenShif
OSV
Exposure of Sensitive Information in keycloak
osv·2021-09-20
CVE-2020-1744 [MEDIUM] Exposure of Sensitive Information in keycloak
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
GHSA
Exposure of Sensitive Information in keycloak
ghsa·2021-09-20
CVE-2020-1744 [MEDIUM] CWE-200 Exposure of Sensitive Information in keycloak
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
No detection rules found.
No public exploits indexed.
2020-03-24
Published