Keycloak CVE-2016-8629 Security Bypass Vulnerability

Keycloak is prone to a security-bypass vulnerability.

An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks.

Information

Bugtraq ID: 97392
Class: Design Error
CVE: CVE-2016-8629

Remote: Yes
Local: No
Published: Apr 04 2017 12:00AM
Updated: Apr 18 2017 01:04AM
Credit: Chess Hazlett
Vulnerable: Redhat Single Sign-On 7.1 for RHEL 7 Serve
Redhat Single Sign-On 7.1 for RHEL 6 Serve
Redhat Single Sign-On 7.1
Redhat Single Sign-On 7.0 for RHEL 7 Serve
Redhat Single Sign-On 7.0 for RHEL 6 Serve
Redhat Single Sign-On 7.0
Redhat keycloak 0

Not Vulnerable: Redhat Single Sign-On 7.1 for RHEL 6 Server 0
Redhat Single Sign-On 7.1 for RHEL 7 Serve
Redhat Single Sign-On 7.1

References:

Keycloak Homepage (keycloak)
Bug 1388988 CVE-2016-8629 keycloak: user deletion via incorrect permissions chec (Redhat)
RHSA-2017:0872 Red Hat Single Sign-On 7.1 update on RHEL 6 (Redhat)
RHSA-2017:0873 Red Hat Single Sign-On 7.1 update on RHEL 7 (Redhat)
RHSA-2017:0876 Red Hat Single Sign-On 7.1 update (Redhat)

Source: www.securityfocus.com

Exploit Collector

Search Exploit

Keycloak CVE-2016-8629 Security Bypass Vulnerability

Information