A vulnerability classified as problematic was found in Keycloak (affected version not known). This vulnerability affects some unknown functionality of the component User Registration Handler. The manipulation of the argument password/password-confirm with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. As an impact it is known to affect confidentiality. CVE summarizes:

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.

The weakness was released 09/13/2023 as GHSA-5q66-v53q-pm35. The advisory is available at github.com. This vulnerability was named CVE-2023-4918 since 09/12/2023. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1040 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Name

• Keycloak

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion