CVE-2019-14909CWE-287CWE-305CWE-592

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be…

Critical · published December 4, 2019

CVSS v3.0
9.3
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

The record
Technical detail
CVSS v3.0
9.3 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01076 · 64.7th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-305 · Authentication Bypass by Primary Weakness; CWE-592 · DEPRECATED: Authentication Bypass Issues
Published
2019-12-04T14:34Z
EPSS history
Timeline
  • 04 DEC 14:34Z
    A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be…
    cvelistv5