CVE-2020-14302 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-14302 PUBLISHED CVSS 4.900000095367432 MEDIUM

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

EPSS 0.15% · 36.0th percentile

Risk Scores

CVSS v3.1

4.900000095367432

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS Score

0.15%

36.0th percentile

Affected Products

Vendor	Product	Versions
n/a	keycloak	*
redhat	keycloak	0

Timeline

Dec 15, 2020 CVE Published
Dec 15, 2020 PoC Published
Dec 18, 2020 CVE Updated
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 28, 2022 EPSS Score

References

Open in Interactive Console →