CVE-2020-27826

Description

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the users metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

Risk Information

Base Score

4.2

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.166

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-27826,CVE-2020-14389 are fixed in Keycloak-core 12.0.0	Windows
Vulnerabilities CVE-2020-27826,CVE-2020-14389 are fixed in Keycloak-core for Linux 12.0.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234