Information Disclosure Vulnerability in Keycloak by Red Hat
CVE-2020-1698

5MEDIUM

Key Information:

Vendor
Red Hat
Status
Keycloak
Vendor
CVE Published:
11 May 2020

Summary

A vulnerability exists in Keycloak prior to version 9.0.0 that may lead to information disclosure. This flaw arises from a logged exception within the HttpMethod class, potentially exposing sensitive data such as user passwords provided as parameters. Attackers can exploit this issue to gain unauthorized access to confidential information, underscoring the importance of upgrading to the latest version to mitigate risks.

Affected Version(s)

keycloak All versions before 9.0.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698
x_refsource_CONFIRM

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.