org.keycloak:keycloak-ldap-federation@1.0-beta-4 vulnerabilities
latest version
26.1.4
latest non vulnerable version
first published
10 years ago
latest version published
22 days ago
licenses detected
- [1.0-beta-4,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.keycloak:keycloak-ldap-federation package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel that allows a user with an expired or disabled Active Directory account to trigger a password reset and gain access to the account. This is due to the fact that the password reset operation is executed without first validating the new credentials against Active Directory via an LDAP bind. How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade | [0,26.1.0) |
Affected versions of this package are vulnerable to Unprotected Transport of Credentials for the LDAP testing endpoint, which allows the modification of the How to fix Unprotected Transport of Credentials? Upgrade | [,24.0.6)[25.0.0,25.0.1) |
Affected versions of this package are vulnerable to LDAP Injection through the How to fix LDAP Injection? Upgrade | [,23.0.1) |