CVE-2020-1758 — Improper Validation of Certificate with Host Mismatch in Redhat Keycloak
Severity
5.9MEDIUMNVD
CNA5.3
EPSS
0.3%
top 51.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 15
Latest updateFeb 9
Description
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages3 packages
🔴Vulnerability Details
3📋Vendor Advisories
1Red Hat▶
keycloak: improper verification of certificate with host mismatch could result in information disclosure↗2020-05-12
💬Community
1Bugzilla▶
CVE-2020-1758 keycloak: improper verification of certificate with host mismatch could result in information disclosure↗2020-03-11