Description
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2050228
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-076.txt
https://www.syss.de/pentest-blog/fehlerhafte-autorisierung-bei-red-hat-single-sign-on-750ga-syss-2021-076
Related Vulnerabilities
CVE-2023-37478 Vulnerability in npm package @pnpm/linuxstatic-arm64
CVE-2020-6427 Vulnerability in npm package electron
CVE-2022-34782 Vulnerability in maven package org.jenkins-ci.plugins:requests
CVE-2017-12617 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2020-2211 Vulnerability in maven package com.elasticbox.jenkins-ci.plugins:kubernetes-ci