-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of password fields during user registration. Keycloak's user profile subsystem (org.keycloak.userprofile) processes form parameters and persists them as user attributes. The 'validate' and 'create' methods in UserProfile.java are central to attribute management. Since the advisory explicitly references the userprofile package and the issue manifests in attribute storage, these functions likely failed to exclude sensitive password fields. The high confidence comes from the CVE's direct association with the userprofile component and the described attack vector involving attribute exposure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-core | maven | = 22.0.2 | 22.0.3 |
JavaJavaOngoing coverage of React2Shell