CVE-2021-4133

EPSS 1.3%CWE-863

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

25 jan 2022Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Produtos afetados

n/a · Keycloak

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://bugzilla.redhat.com/show_bug.cgi?id=2033602 https://github.com/keycloak/keycloak/issues/9247 https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 https://www.oracle.com/security-alerts/cpuapr2022.html