What is GHSA-c7xw-p58w-h6fj?

GHSA-c7xw-p58w-h6fj is a security advisory published by GitHub Security Advisories with Medium severity. Keycloak: Impersonation and lockout possible through incorrect handling of email trust

Which CVE IDs does GHSA-c7xw-p58w-h6fj cover?

GHSA-c7xw-p58w-h6fj covers the following CVE IDs: CVE-2023-0105. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c7xw-p58w-h6fj?

GHSA-c7xw-p58w-h6fj has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c7xw-p58w-h6fj?

GHSA-c7xw-p58w-h6fj affects 1 product, including: maven/org.keycloak:keycloak-core:\u003c 22.0.1.

GHSA-c7xw-p58w-h6fjMediumCVSS 6.5

Keycloak: Impersonation and lockout possible through incorrect handling of email trust

Vendor

GitHub Security Advisories

Published

July 18, 2023

Last Modified

July 18, 2023

🔗 CVE IDs covered (1)

CVE-2023-0105 →

📋 Description

Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.

🎯 Affected products1

maven/org.keycloak:keycloak-core:< 22.0.1

🔗 References (5)

https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
https://access.redhat.com/security/cve/CVE-2023-0105
https://bugzilla.redhat.com/show_bug.cgi?id=2158910
https://github.com/advisories/GHSA-c7xw-p58w-h6fj