CVE-2018-14657

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

CVSS v3 8.1 HIGH
CVSS v2.0 4.3 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://access.redhat.com/errata/RHSA-2018:3592	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:keycloak:4.2.1:::::::*
	cpe:2.3:a:redhat:keycloak:4.3.0:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

History

No history.

Information

Published : 2018-11-13 19:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-14657

Mitre link : CVE-2018-14657

CVE.ORG link : CVE-2018-14657

JSON object : View

Products Affected

redhat

single_sign-on
linux
keycloak

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2018-14657", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2018-11-13T19:29:00.337", "references": [{"url": "https://access.redhat.com/errata/RHSA-2018:3592", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2018:3593", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2018:3595", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures."}, {"lang": "es", "value": "Se ha descubierto un error en Keycloak 4.2.1.Final y 4.3.0.Final. Cuando TOPT est\u00e1 habilitado, la implementaci\u00f3n incorrecta del algoritmo de detecci\u00f3n de fuerza bruta no aplica sus medidas de protecci\u00f3n."}], "lastModified": "2023-02-02T17:16:17.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:keycloak:4.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CE2C1F8-8B2D-4334-ADFC-D2B67CBF0E94"}, {"criteria": "cpe:2.3:a:redhat:keycloak:4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45BFBB51-AC74-453F-B24D-2BB1E04BD410"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FABBE0BB-135A-458C-BD84-54C052FFDC57"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "29B186E5-7C2F-466E-AA4A-8F2B618F8A14"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FABBE0BB-135A-458C-BD84-54C052FFDC57"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2DFA94D5-0139-490C-8257-0751FE9FBAE4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*", "vulnerable": true, "matchCriteriaId": "341E6313-20D5-44CB-9719-B20585DC5AD6"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}