Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2019-14909

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

VectorNETWORK

PublishedDec 04, 2019, 15:15

Published Bysecalert@redhat.com

Base Score

Score8.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.keycloak:keycloak-parent(Maven)7.0.0N/AN/A

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909

Weakness Type

CWE-287

CVSS Metrics

Base Score

8.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK