<p>Upgrade <code>org.keycloak:keycloak-services</code> to version 22.0.1 or higher.</p>

Improper Authorization Affecting org.keycloak:keycloak-services package, versions [,22.0.1)

Threat Intelligence

Proof of concept

0.07% (31^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGKEYCLOAK-6230714
published 7 Feb 2024
disclosed 13 Jan 2023
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 13 Jan 2023

CVE-2023-0105 Open this link in a new tab CWE-285 Open this link in a new tab

How to fix?

Upgrade org.keycloak:keycloak-services to version 22.0.1 or higher.

Overview

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Authorization such that the verified state is not reset when the email changes. It is possible for users to shadow others with the same email and lockout or impersonate them.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

Low
Integrity (I)

Low
Availability (A)

Low