CVE-2020-1744CWE-755

A flaw was found in keycloak before version 9.0.1

Medium · published March 24, 2020

CVSS v3.1
5.6
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01129 · 66.1th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2020-03-24T00:00Z
EPSS history
Timeline
  • 24 MAR 00:00Z
    A flaw was found in keycloak before version 9.0.1
    cvelistv5