CPE Details
Red Hat Single Sign-on 7.5.0
7.5.0
2022-05-04
16h33 +00:00
16h33 +00:00
2022-06-06
11h54 +00:00
11h54 +00:00
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
CPE Name: cpe:2.3:a:redhat:single_sign-on:7.5.0:*:*:*:*:*:*:*
Informations
Vendor
redhatProduct
single_sign-onVersion
7.5.0Related CVE
| CVE ID | Publié | Description | Score | Gravité |
|---|---|---|---|---|
| A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748. | 5.4 |
Moyen |
||
| A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability. | 5 |
Moyen |
||
| A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity. | 6.8 |
Moyen |
||
| Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted. | 6.5 |
Moyen |
