CVE-2020-1744

Description

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

Risk Information

Base Score

5.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score

Exploitation Probability

0.333

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-1744 are fixed in Keycloak-core 9.0.1	Windows
Vulnerabilities CVE-2020-1744 are fixed in Keycloak-core for Linux 9.0.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234