VulnerabilityModified
CVE-2023-0105
This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak.
MEDIUM 6.5EPSS 0.70%
Does this matter?
Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 0.70% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- redhat/keycloak
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/CVE-2023-0105Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-0105Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.