Description

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758

https://issues.redhat.com/browse/KEYCLOAK-13285

Related Vulnerabilities

CVE-2021-23265 Vulnerability in maven package org.craftercms:crafter-core

CVE-2018-14042 Vulnerability in maven package org.webjars.bower:bootstrap

CVE-2020-2143 Vulnerability in maven package org.jenkins-ci.plugins:logstash

CVE-2023-34615 Vulnerability in maven package net.pwall.json:jsonutil

CVE-2020-7652 Vulnerability in npm package snyk-broker

Severity

Medium

Classification

CWE-295 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Vendor Advisory Permissions Required