What is CVE-2019-10169?

CVE-2019-10169 is a vulnerability found in Keycloak's user-managed access interface that allows an authenticated attacker to execute arbitrary code with the permissions of the user running the application.

What is the severity of CVE-2019-10169?

CVE-2019-10169 has a severity rating of 7.2, which is considered high.

How can an attacker exploit CVE-2019-10169?

An attacker with UMA permissions can exploit CVE-2019-10169 by configuring a malicious script in the UMA policy, which can trigger and execute arbitrary code.

Which software versions are affected by CVE-2019-10169?

CVE-2019-10169 affects Redhat Keycloak versions up to exclusive 8.0.0.

Is there a fix for CVE-2019-10169?

Yes, to fix CVE-2019-10169, it is recommended to update Keycloak to a version beyond 8.0.0.

Vulnerability/
CVE-2019-10169

high

7.2

CWE

267

8/5/2020

24/5/2022

23/4/2024

CVE-2019-10169

First published: Fri May 08 2020(Updated: )

A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.

Credit: secalert@redhat.com secalert@redhat.com

Affected Software	Affected Version	How to fix
Redhat Keycloak	<8.0.0
maven/org.keycloak:keycloak-authz-client	<8.0.0	8.0.0
	<8.0.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2019-10169?
CVE-2019-10169 is a vulnerability found in Keycloak's user-managed access interface that allows an authenticated attacker to execute arbitrary code with the permissions of the user running the application.
What is the severity of CVE-2019-10169?
CVE-2019-10169 has a severity rating of 7.2, which is considered high.
How can an attacker exploit CVE-2019-10169?
An attacker with UMA permissions can exploit CVE-2019-10169 by configuring a malicious script in the UMA policy, which can trigger and execute arbitrary code.
Which software versions are affected by CVE-2019-10169?
CVE-2019-10169 affects Redhat Keycloak versions up to exclusive 8.0.0.
Is there a fix for CVE-2019-10169?
Yes, to fix CVE-2019-10169, it is recommended to update Keycloak to a version beyond 8.0.0.

collector/nvd-index
agent/type
agent/first-publish-date
collector/github-advisory-latest
source/GitHub
alias/GHSA-9c24-43p5-fv82
alias/CVE-2019-10169
agent/software-canonical-lookup
agent/weakness
agent/last-modified-date
agent/references
agent/description
agent/author
agent/severity
agent/softwarecombine
agent/tags
agent/event
collector/nvd-cve
source/NVD
collector/github-advisory
vendor/redhat
canonical/redhat keycloak
package-manager/maven

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.