CVE-2019-10201

Description

It was found that Keycloaks SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

Risk Information

Base Score
8.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.136

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2019-10199,CVE-2019-10201 are fixed in Keycloak-core 7.0.0Windows
Vulnerabilities CVE-2019-10199,CVE-2019-10201 are fixed in Keycloak-core for Linux 7.0.0Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234