CVE-2020-1758 – org.keycloak:keycloak-parent

Package

Manager: maven
Name: org.keycloak:keycloak-parent
Vulnerable Version: >=0 <10.0.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00254 pctl0.48589

Details

Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Metadata

Created: 2022-02-09T00:56:26Z
Modified: 2021-04-01T21:57:32Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-c597-f74m-jgc2/GHSA-c597-f74m-jgc2.json
CWE IDs: ["CWE-295", "CWE-297"]
Alternative ID: GHSA-c597-f74m-jgc2
Finding: F163
Auto approve: 1