GHSA-7m27-3587-83xf

    Dashboard / Vulnerabilities / GHSA-7m27-3587-83xf

    GHSA-7m27-3587-83xf

    Published: 21 Oct 2021Last Modified: 8 Nov 2023

    Summary: Privilege Defined With Unsafe Actions in Keycloak

    Details: A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-10170, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10170, https://github.com/keycloak/keycloak

    Affected packages

    Package

    Name: org.keycloak:keycloak-core

    Purl: pkg:maven/org.keycloak/keycloak-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -8.0.0

    Affected versions

    1.0-alpha-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-7m27-3587-83xf | CVE-DB