CVE-2018-10894 MEDIUM

CVE-2018-10894

Vendor Red Hat

Product keycloak

Weakness CWE-345

Published August 1, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

Key dates

02Disclosure timeline

August 1, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-10894 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/345.html

Related vulnerabilities

04Related CVE

CVE-2023-42782 CVE-2021-20271 CVE-2023-4589 Insufficient verification of data authenticity vulnerability in Delinea Secret Server CVE-2026-24775 OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension CVE-2019-1932 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability