CVE-2020-10758 — Vulnetix

CVE-2020-10758 PUBLISHED CVSS 7.5 HIGH

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

EPSS 0.53% · 67.6th percentile

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.53%

67.6th percentile

Affected Products

Vendor	Product	Versions
redhat	openshift_application_runtimes	1.0
Maven	org.keycloak:keycloak-parent	0
redhat	keycloak	0
redhat	single_sign-on	7.0, 7.4
n/a	Keycloak	Keycloak before 11.0.1

Exploit Intelligence

CIRCL seen: CVE-2020-10758 (circl-sighting)
CIRCL published-proof-of-concept: CVE-2020-10758 (circl-sighting)
https://bugzilla.redhat.com/show_bug.cgi?id=1843849 (circl)
https://github.com/keycloak/keycloak/commit/bee4ca89897766c4b68856eafe14f1a3dad34251 (circl)

Timeline

Sep 5, 2020 PoC Published
Sep 16, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jun 8, 2022 PoC Published
Jul 3, 2022 EPSS Score

References

Open in Interactive Console →