CVE-2020-1758

Description

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Risk Information

Base Score

5.9

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.254

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-1694,CVE-2020-1758 are fixed in Keycloak - keycloak-parent 10.0.0	Windows
Vulnerabilities CVE-2020-1694,CVE-2020-1758 are fixed in Keycloak - keycloak-parent for Linux 10.0.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234