CVE-2021-3513: redhat keycloak Insufficiently Protected Credentials

Vulnerability summary

CVE-2021-3513 is a high (CVSS 7.5) Insufficiently Protected Credentials vulnerability in redhat keycloak. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities.

Timeline

1. 22-08-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
• CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.