CVE-2020-1731
02.03.2020, 17:15
A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | keycloak_operator | 𝑥 < 8.0.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-341 - Predictable from Observable StateA number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
- CWE-330 - Use of Insufficiently Random ValuesThe software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.