CVE-2023-4918: Plaintext storage of user password
First published: Tue Sep 12 2023(Updated: )
A flaw was discovered in Keycloak Core package. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular attributes in the users attributes. The password is also created, but the user attributes must not be there. This way, any entities (all users and clients with proper rights/roles) are able to retrieve the users passwords in clear-text. ### Impact Passwords for self-registered users are stored as cleartext attributes associated with the user. ### Mitigation Disable self-registration for users in all realms until patched.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.keycloak:keycloak-core | =22.0.2 | 22.0.3 |
| Redhat Keycloak | =22.0.2 | |
| redhat/keycloak | <22.0.3 | 22.0.3 |
| =22.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-4918?
CVE-2023-4918 is a vulnerability found in the Keycloak Core package, specifically in org.keycloak.userprofile.
What is the severity of CVE-2023-4918?
CVE-2023-4918 has a severity level of 8.8 (high).
How does CVE-2023-4918 impact Keycloak?
CVE-2023-4918 allows user attributes to contain the 'password' and 'password-confirm' fields, which can lead to unauthorized access.
How can I fix CVE-2023-4918?
To fix CVE-2023-4918, update to Keycloak version 22.0.3 or higher.
Where can I find more information about CVE-2023-4918?
You can find more information about CVE-2023-4918 in the following references: [1] [2] [3].
- collector/github-advisory-latest
- alias/GHSA-5q66-v53q-pm35
- alias/CVE-2023-4918
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/title
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- agent/trending
- package-manager/maven
- vendor/redhat
- canonical/redhat keycloak
- version/redhat keycloak/22.0.2
- package-manager/redhat