Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1qOXhxLWozMjktMnh2Z84AAufz
Keycloak user may register themselves with same email ID of any existing user
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
Permalink: https://github.com/advisories/GHSA-j9xq-j329-2xvgJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qOXhxLWozMjktMnh2Z84AAufz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: about 1 year ago
CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Identifiers: GHSA-j9xq-j329-2xvg, CVE-2021-3754
References:
- https://nvd.nist.gov/vuln/detail/CVE-2021-3754
- https://access.redhat.com/security/cve/CVE-2021-3754
- https://bugzilla.redhat.com/show_bug.cgi?id=1999196
- https://github.com/advisories/GHSA-j9xq-j329-2xvg
Affected Packages
maven:org.keycloak:keycloak-core
Dependent packages: 376Dependent repositories: 1,153
Downloads:
Affected Version Ranges: <= 19.0.1
No known fixed version
All affected versions: 5.0.0, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 8.0.2, 9.0.0, 9.0.2, 9.0.3, 10.0.0, 10.0.1, 10.0.2, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 13.0.0, 13.0.1, 14.0.0, 15.0.0, 15.0.1, 15.0.2, 15.1.0, 15.1.1, 16.0.0, 16.1.0, 16.1.1, 17.0.0, 17.0.1, 18.0.0, 18.0.1, 18.0.2, 19.0.0, 19.0.1