Keycloak DoS via account lockout · CVE-2024-1722 · GitHub Advisory Database · GitHub

Keycloak DoS via account lockout

Low severity GitHub Reviewed Published Feb 29, 2024 to the GitHub Advisory Database • Updated Feb 29, 2024

Package

org.keycloak:keycloak-core (Maven)

Affected versions

<= 23.0.5

Patched versions

None

Description

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.

References

Published by the National Vulnerability Database

Feb 29, 2024

Published to the GitHub Advisory Database Feb 29, 2024

Reviewed Feb 29, 2024

Last updated Feb 29, 2024

Severity

Low

3.7

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L