From a844275a9019f4b1a1b23a5cf4e8d1ccef077967 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 17:38:22 +0000 Subject: [PATCH] Publish Advisories GHSA-9695-w6h2-jpv9 GHSA-9c24-43p5-fv82 GHSA-9695-w6h2-jpv9 GHSA-9c24-43p5-fv82 --- .../GHSA-9695-w6h2-jpv9.json | 68 +++++++++++++++++++ .../GHSA-9c24-43p5-fv82.json | 65 ++++++++++++++++++ .../GHSA-9695-w6h2-jpv9.json | 38 ----------- .../GHSA-9c24-43p5-fv82.json | 35 ---------- 4 files changed, 133 insertions(+), 73 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json diff --git a/advisories/github-reviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json b/advisories/github-reviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json new file mode 100644 index 00000000000..77107fc6ea8 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9695-w6h2-jpv9", + "modified": "2024-04-23T17:37:22Z", + "published": "2022-05-24T17:17:05Z", + "aliases": [ + "CVE-2020-10686" + ], + "summary": "Keycloak users may be able to remove MFA from other users' devices", + "details": "A community-only flaw was found where a malicious user can register himself and then uses the \"remove devices\" form to post different credential ids with the hope of removing MFA devices for other users. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.0.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.0.1" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10686" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/5ddd605ee96b8551c7eb00b609a0b97939925b77" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:37:22Z", + "nvd_published_at": "2020-05-04T21:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json b/advisories/github-reviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json new file mode 100644 index 00000000000..247abc4ebc1 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9c24-43p5-fv82", + "modified": "2024-04-23T17:36:16Z", + "published": "2022-05-24T22:28:29Z", + "aliases": [ + "CVE-2019-10169" + ], + "summary": "Keycloak code execution via UMA policy abuse", + "details": "A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-authz-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10169" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10169" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + }, + { + "type": "WEB", + "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-568797" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-267" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T17:36:16Z", + "nvd_published_at": "2020-05-08T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json b/advisories/unreviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json deleted file mode 100644 index 72fc9b737f6..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-9695-w6h2-jpv9/GHSA-9695-w6h2-jpv9.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9695-w6h2-jpv9", - "modified": "2022-08-06T00:00:37Z", - "published": "2022-05-24T17:17:05Z", - "aliases": [ - "CVE-2020-10686" - ], - "details": "A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10686" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-05-04T21:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json b/advisories/unreviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json deleted file mode 100644 index 35332c6dd8c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-9c24-43p5-fv82/GHSA-9c24-43p5-fv82.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9c24-43p5-fv82", - "modified": "2022-05-24T22:28:29Z", - "published": "2022-05-24T22:28:29Z", - "aliases": [ - "CVE-2019-10169" - ], - "details": "A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10169" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10169" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-05-08T14:15:00Z" - } -} \ No newline at end of file