GHSA-f32v-vf79-p29q

Improper authorization in Keycloak

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-1466

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.keycloak:keycloak-core	< 17.0.1	17.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-1466 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2050228 web
https://github.com/keycloak/keycloak package
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-076.txt web
https://www.syss.de/pentest-blog/fehlerhafte-autorisierung-bei-red-hat-single-sign-on-750ga-syss-2021-076 web