Bug 1796281 (CVE-2020-1717)

Summary:	CVE-2020-1717 Keycloak: A logged in user can do an account email enumeration attack
Product:	[Other] Security Response	Reporter:	Paramvir jindal <pjindal>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, avibelli, bgeorges, chazlett, cmoulliard, dkreling, gmalinko, ikanello, janstey, jbalunas, jochrist, jpallich, jwon, lthon, pdrozd, pgallagh, pjindal, rruss, sthorger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in keycloak. An attacker could use the change email function in the account settings to determine if an email address was already used for another account (an account enumeration attack). The highest threat from this flaw is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1771890

Description Paramvir jindal 2020-01-30 05:31:15 UTC

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. 

References: 
 
https://issues.jboss.org/browse/KEYCLOAK-12014

Comment 2 Paramvir jindal 2020-01-30 05:36:45 UTC

Marking RHSSO 7 as affected.

Comment 7 Eric Christensen 2021-02-16 20:31:02 UTC

External References:

https://issues.redhat.com/browse/KEYCLOAK-12014