Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-4133

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Published

2022-01-25T20:15:08.607

Last Modified

2024-11-21T06:36:58.400

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-863
Type: Primary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	keycloak	< 15.1.1	Yes

References

https://bugzilla.redhat.com/show_bug.cgi?id=2033602 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/keycloak/keycloak/issues/9247 Third Party Advisory ([email protected])
https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpuapr2022.html Not Applicable ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2033602 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/keycloak/keycloak/issues/9247 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2022.html Not Applicable (af854a3a-2127-422b-91ae-364da2661108)