CVE-2020-1724
Fixed in a distro release EPSS <1%CVSS 4.3
A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.
Products: Red Hat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 9.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat:red_hat_single_sign_on:7 | rh-sso7-keycloak | 0:4.8.20-1.Final_redhat_00001.1.el6sso |
| Red Hat:red_hat_single_sign_on:7 | rh-sso7-keycloak | 0:4.8.20-1.Final_redhat_00001.1.el7sso |
| Red Hat:red_hat_single_sign_on:7 | rh-sso7-keycloak | 0:4.8.20-1.Final_redhat_00001.1.el8sso |
| Red Hat:red_hat_single_sign_on:7 | rh-sso7-keycloak-server | 0:4.8.20-1.Final_redhat_00001.1.el6sso |
| Red Hat:red_hat_single_sign_on:7 | rh-sso7-keycloak-server | 0:4.8.20-1.Final_redhat_00001.1.el7sso |
| Red Hat:red_hat_single_sign_on:7 | rh-sso7-keycloak-server | 0:4.8.20-1.Final_redhat_00001.1.el8sso |