CVE-2020-1758CWE-297

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server

Medium · published May 15, 2020

CVSS v3.1
5.3
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00928 · 60.2th percentile
Weakness
CWE-297 · Improper Validation of Certificate with Host Mismatch
Published
2020-05-15T18:52Z
EPSS history
Timeline
  • 15 MAY 18:52Z
    A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server
    cvelistv5