CVE-2019-14910

CVSS v3.1 9.8 (Critical)

CVSS v2.0 7.5 (High)

EPSS 0.18 % (56^th)

Affected Products 1

Advisories 1

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.

Weaknesses

CWE-287: Improper Authentication
CWE-295: Improper Certificate Validation
CWE-305: Authentication Bypass by Primary Weakness
CWE-592: DEPRECATED: Authentication Bypass Issues

CVE Status: PUBLISHED
CNA: Red Hat, Inc.
Published Date: 2019-12-05 15:15:11
(4 years ago)
Updated Date: 2020-10-09 13:33:45
(4 years ago)

Affected Products

Redhat

Keycloak

Configuration #1

		CPE23	From	Up To
	Redhat Keycloak 7.0.0	cpe:2.3:a:redhat:keycloak:7.0.0
	Redhat Keycloak 7.0.1	cpe:2.3:a:redhat:keycloak:7.0.1