It was found that Keycloak's SAML ... CVE-2019-10201

- AV AC AU C I A
发布: 2019-08-14
修订: 2019-08-19

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

0%
暂无可用Exp或PoC
产品及版本信息(CPE)暂不可用