CVE-2021-3754: Input Validation
First published: Mon Aug 30 2021(Updated: )
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Keycloak | ||
| Redhat Single Sign-on | =7.0 | |
| maven/org.keycloak:keycloak-services | <24.0.1 | 24.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2021-3754
- https://bugzilla.redhat.com/show_bug.cgi?id=1999196
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4x
- https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e
- https://nvd.nist.gov/vuln/detail/CVE-2021-3754
- https://github.com/advisories/GHSA-4vc8-pg5c-vg4x (Advisory)
Frequently Asked Questions
What is CVE-2021-3754?
CVE-2021-3754 is a vulnerability found in Keycloak that allows an attacker to register themselves with the username same as the email ID of an existing user, causing issues with password recovery.
What is the severity of CVE-2021-3754?
The severity of CVE-2021-3754 is medium, with a CVSSv3 base score of 5.3.
What software is affected by CVE-2021-3754?
Redhat Keycloak and Redhat Single Sign-on version 7.0 are affected by CVE-2021-3754.
How can an attacker exploit CVE-2021-3754?
An attacker can exploit CVE-2021-3754 by registering themselves with the same username as the email ID of an existing user.
Are there any references for CVE-2021-3754?
Yes, you can find more information about CVE-2021-3754 at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1999196) and [Red Hat Security](https://access.redhat.com/security/cve/CVE-2021-3754).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3754
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4vc8-pg5c-vg4x
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- agent/trending
- collector/nvd-cve
- source/NVD
- vendor/redhat
- canonical/redhat keycloak
- canonical/redhat single sign-on
- version/redhat single sign-on/7.0
- package-manager/maven