Description

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.

Remediation

References

https://access.redhat.com/security/cve/CVE-2021-3754

https://bugzilla.redhat.com/show_bug.cgi?id=1999196

Related Vulnerabilities

CVE-2018-8035 Vulnerability in maven package org.apache.uima:uima-ducc-web

CVE-2020-36732 Vulnerability in maven package org.webjars.bowergithub.brix:crypto-js

CVE-2023-29209 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro

CVE-2022-34192 Vulnerability in maven package org.jenkins-ci.plugins:ontrack

CVE-2018-12536 Vulnerability in maven package org.eclipse.jetty:jetty-server

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Tags

Vendor Advisory Issue Tracking NVD-CWE-noinfo