Bug 1796281 (CVE-2020-1717)

Summary: CVE-2020-1717 Keycloak: A logged in user can do an account email enumeration attack
Product: [Other] Security Response Reporter: Paramvir jindal <pjindal>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aileenc, avibelli, bgeorges, chazlett, cmoulliard, dkreling, gmalinko, ikanello, janstey, jbalunas, jochrist, jpallich, jwon, lthon, pdrozd, pgallagh, pjindal, rruss, sthorger
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in keycloak. An attacker could use the change email function in the account settings to determine if an email address was already used for another account (an account enumeration attack). The highest threat from this flaw is to data confidentiality.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1771890    

Description Paramvir jindal 2020-01-30 05:31:15 UTC
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. 


Comment 2 Paramvir jindal 2020-01-30 05:36:45 UTC
Marking RHSSO 7 as affected.

Comment 7 Eric Christensen 2021-02-16 20:31:02 UTC
External References: