Description
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
Remediation
References
https://access.redhat.com/security/cve/cve-2020-14389
https://bugzilla.redhat.com/show_bug.cgi?id=1875843%2C
Related Vulnerabilities
CVE-2019-16546 Vulnerability in maven package org.jenkins-ci.plugins:google-compute-engine
CVE-2019-10342 Vulnerability in maven package io.jenkins.docker:docker-plugin
CVE-2020-7653 Vulnerability in npm package snyk-broker
CVE-2023-39154 Vulnerability in maven package com.qualys.plugins:qualys-was
CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-framework