CVE-2020-35509

EPSS 0.09%
Published 23.08.2022 16:15:08
Last modified 30.06.2025 21:15:28
Source secalert@redhat.com
Teams watchlist Login
Open Login

A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected products Warnungen 0 Metrics 3 CWE 2 References 4

Data is provided by the National Vulnerability Database (NVD)

Redhat ≫ Keycloak Version11.0.3

Redhat ≫ Keycloak Version12.0.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.09%	0.259

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://access.redhat.com/security/cve/cve-2020-35509

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-35509

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-35509

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-35509

EUVD