CVE Feed

    Dashboard / CVE / CVE-2020-14341

    CVE-2020-14341

    The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.

    Published:Nov 18, 2020
    Last Modified:Nov 21, 2024
    EPS:Jan 12, 2021
    EPSS Score:0.00298
    CVSS Score:2.7

    Affected Products

    Vendor
    Redhat
    Product
    Single Sign-on

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-385 Covert Timing Channel

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-462 Cross-Domain Search Timing

    Related CVEs

    CVE-2026-82968 (CVSS 6.4) — A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links…
    CVE-2026-19608 (CVSS 5.3) — A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine…
    CVE-2026-16443 (CVSS 7.4) — A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the co…
    CVE-2026-15573 (CVSS 8.1) — A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to…
    CVE-2026-16102 (CVSS 8.1) — A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access manage…
    CVE-2026-18967 (CVSS 6.4) — A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When co…
    CVE-2026-18570 (CVSS 5.4) — A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. Thi…
    CVE-2026-18571 (CVSS 6.6) — A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) i…
    CVE-2026-18572 (CVSS 6.5) — Keycloak provides authorization services that allow administrators to restrict access to resources based on ti…
    CVE-2026-18573 (CVSS 6.5) — A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High