<p>Upgrade <code>org.keycloak:keycloak-services</code> to version 7.0.0 or higher.</p>

Access Control Bypass Affecting org.keycloak:keycloak-services package, versions [,7.0.0)

Threat Intelligence

0.07% (30^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGKEYCLOAK-461005
published 14 Aug 2019
disclosed 10 Jul 2019
credit Marian Rehak

Report a new vulnerability Found a mistake?

Introduced: 10 Jul 2019

CVE-2019-10201 Open this link in a new tab CWE-285 Open this link in a new tab

How to fix?

Upgrade org.keycloak:keycloak-services to version 7.0.0 or higher.

Overview

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access Control Bypass. The SAML broker used within keycloak did not verify missing message signatures. As such, it is possible for an attacker to modify the SAML Response and remove the section and impersonate another user to gain unauthorized access. This is due to the SAML message is still accepted by the package after being tampered with.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

None
Availability (A)

None