Password Reset Vulnerability in Keycloak by Red Hat
CVE-2019-14837
9.1CRITICAL
What is CVE-2019-14837?
A vulnerability exists in the Keycloak identity and access management software, allowing an attacker to reset a user’s password. By setting up a mail server with the domain 'placeholder.org', an attacker can exploit the system by only knowing the client's name, such as 'test', and use predetermined email formats to gain unauthorized access. For instance, the email would be formed as 'service-account-test@placeholder.org', thereby enabling the attacker to log in as the affected client.
Affected Version(s)
keycloak before 8.0.0
References
CVSS V3.1
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved