From 7e974ef4f08328f492909f102e03aacfed8a6a4c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 10 Mar 2025 21:10:33 +0000 Subject: [PATCH] Publish Advisories GHSA-rq4w-cjrr-h8w8 GHSA-gvgg-2r3r-53x7 --- .../GHSA-rq4w-cjrr-h8w8.json | 11 +-- .../GHSA-gvgg-2r3r-53x7.json | 96 +++++++++++++++++++ 2 files changed, 101 insertions(+), 6 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-gvgg-2r3r-53x7/GHSA-gvgg-2r3r-53x7.json diff --git a/advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json b/advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json index 673bbe78ade..a07fa965422 100644 --- a/advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json +++ b/advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json @@ -1,13 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rq4w-cjrr-h8w8", - "modified": "2025-03-10T18:31:56Z", + "modified": "2025-03-10T21:07:53Z", "published": "2025-02-17T15:32:01Z", - "aliases": [ - "CVE-2025-1391" - ], - "summary": "Keycloak allows Incorrect Assignment of an Organization to a User", - "details": "A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.", + "withdrawn": "2025-03-10T21:07:53Z", + "aliases": [], + "summary": "Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User", + "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-gvgg-2r3r-53x7. This link is maintained to preserve external references.\n\n# Original Description\nA flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/03/GHSA-gvgg-2r3r-53x7/GHSA-gvgg-2r3r-53x7.json b/advisories/github-reviewed/2025/03/GHSA-gvgg-2r3r-53x7/GHSA-gvgg-2r3r-53x7.json new file mode 100644 index 00000000000..88d08a81655 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-gvgg-2r3r-53x7/GHSA-gvgg-2r3r-53x7.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gvgg-2r3r-53x7", + "modified": "2025-03-10T21:09:43Z", + "published": "2025-03-10T21:09:43Z", + "aliases": [ + "CVE-2025-1391" + ], + "summary": "Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims ", + "details": "This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk increases in scenarios where self-registration is enabled and unrestricted, allowing an attacker to exploit the naming pattern. The issue is mitigated if admins restrict registration or use strict validation mechanisms.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "26.1.0" + }, + { + "fixed": "26.1.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "26.0.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-gvgg-2r3r-53x7" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1391" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/5aa2b4c75bb474303ab807017582bc01a9f7e378" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2545" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-1391" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346082" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-10T21:09:43Z", + "nvd_published_at": null + } +} \ No newline at end of file