CVE-2020-1758 PUBLISHED CVSS 5.3 MEDIUM

Reported by redhat · Published May 15, 2020

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Risk Scores

CVSS v3.1
5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red Hatkeycloakkeycloak versions before 10.0.0
Mavenorg.keycloak:keycloak-parent0, 0, 0
Red Hatkeycloakkeycloak versions before 10.0.0, keycloak versions before 10.0.0, keycloak versions before 10.0.0
Mavenorg.keycloak:keycloak-services0, 0, 0
Mavenorg.keycloak:keycloak-core0, 0, 0

Timeline

References

Open in Interactive Console →