cbcvebase.
CVE-2023-4918
published 2023-09-12

CVE-2023-4918: A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password"…

high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.

Affected

1 ranges
VendorProductVersion rangeFixed in
redhatkeycloak——