Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2016-8629

Good to know:

icon

Date: March 12, 2018

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Language: Java

Severity Score

Related Resources (9)

https://access.redhat.com/errata/RHSA-2017:0873
http://www.securitytracker.com/id/1038180
https://bugzilla.redhat.com/show_bug.cgi?id=1388988
http://rhn.redhat.com/errata/RHSA-2017-0876.html
http://www.securityfocus.com/bid/97392
https://github.com/advisories/GHSA-778x-2mqv-w6xw
https://nvd.nist.gov/vuln/detail/CVE-2016-8629
https://access.redhat.com/errata/RHSA-2017:0872
https://www.mend.io/vulnerability-database/CVE-2016-8629

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us