Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-0105

Date: January 11, 2023

A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.

Language: Java

Severity Score

Related Resources (7)

https://access.redhat.com/security/cve/CVE-2023-0105
https://nvd.nist.gov/vuln/detail/CVE-2023-0105
https://bugzilla.redhat.com/show_bug.cgi?id=2158910
https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
https://github.com/keycloak/keycloak
https://www.mend.io/vulnerability-database/CVE-2023-0105

Severity Score

Weakness Type (CWE)

Authentication Issues

CWE-287

Improper Enforcement of Behavioral Workflow

CWE-841

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us