CVE-2020-1725: Incorrect Authorization in keycloak
Summary
CVE-2020-1725: Incorrect Authorization in keycloak. Affects org.keycloak:keycloak-parent versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, user authentication, and authorization. The keycloak-parent package is a Maven project that serves as the parent for other Keycloak modules. It is an essential component of the Keycloak ecosystem.
Vulnerability Detail
A flaw was discovered in Keycloak before version 13.0.0. This vulnerability allows users to retain access to a resource even after modifying their role mappings in Keycloak and the expiration of their previous access token. In certain scenarios, this incorrect authorization can lead to unauthorized access to sensitive resources and potential security breaches.
How To Fix
Minimum fixed version
13.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update to the fixed version of Keycloak to ensure the security of the system.
Conclusion
The vulnerability in Keycloak allows users to retain unauthorized access to resources. It is crucial to update to the fixed version of Keycloak (13.0.0 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Keycloak is an open-source identity and access management solution that provides features such as single sign-on, user authentication, and authorization.
This vulnerability allows users to retain access to a resource even after modifying their role mappings, potentially leading to unauthorized access to sensitive resources.
To fix this vulnerability, it is recommended to upgrade to Keycloak version 13.0.0 or later.
There is no specific workaround provided for this vulnerability. Updating to the fixed version is the recommended solution.
For more information about this vulnerability, you can refer to the CVE-2020-1725 advisory or contact the Keycloak support team.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
