6.8

CVE-2020-1744

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Keycloak Version < 9.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.13% 0.633
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.6 2.2 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat 5.6 2.2 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-755 Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

https://access.redhat.com/security/cve/CVE-2020-1744
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1744
Vendor Advisory
Issue Tracking