Search for vulnerabilities
Vulnerability details: VCID-1d7p-grah-aaam
Vulnerability ID VCID-1d7p-grah-aaam
Aliases CVE-2023-0105
GHSA-c7xw-p58w-h6fj
GHSA-vhvq-jh34-3fc8
Summary Keycloak allows impersonation and lockout due to email trust not being handled correctly
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-287 Improper Authentication
CWE-841 Improper Enforcement of Behavioral Workflow
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0105.json
cvssv3.1 6.5 https://access.redhat.com/security/cve/CVE-2023-0105
ssvc Track https://access.redhat.com/security/cve/CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00415 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
cvssv3.1 6.5 https://bugzilla.redhat.com/show_bug.cgi?id=2158910
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2158910
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-c7xw-p58w-h6fj
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vhvq-jh34-3fc8
cvssv3.1 6.8 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 6.5 https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
cvssv3.1_qr MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-0105
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-0105
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0105.json
https://api.first.org/data/v1/epss?cve=CVE-2023-0105
https://bugzilla.redhat.com/show_bug.cgi?id=2158910
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
CVE-2023-0105 https://access.redhat.com/security/cve/CVE-2023-0105
CVE-2023-0105 https://nvd.nist.gov/vuln/detail/CVE-2023-0105
GHSA-c7xw-p58w-h6fj https://github.com/advisories/GHSA-c7xw-p58w-h6fj
GHSA-c7xw-p58w-h6fj https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
GHSA-vhvq-jh34-3fc8 https://github.com/advisories/GHSA-vhvq-jh34-3fc8
RHSA-2023:7482 https://access.redhat.com/errata/RHSA-2023:7482
RHSA-2023:7483 https://access.redhat.com/errata/RHSA-2023:7483
RHSA-2023:7484 https://access.redhat.com/errata/RHSA-2023:7484
RHSA-2023:7486 https://access.redhat.com/errata/RHSA-2023:7486
RHSA-2023:7488 https://access.redhat.com/errata/RHSA-2023:7488
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0105.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://access.redhat.com/security/cve/CVE-2023-0105
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-09T13:47:18Z/ Found at https://access.redhat.com/security/cve/CVE-2023-0105
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=2158910
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2023-0105
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2023-0105
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.35347
EPSS Score 0.00079
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.