A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0152 advisory.

  - keycloak-server-spi-private: ECP SAML binding bypasses authentication flows (CVE-2021-3827)

  - Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0151 advisory.

  - keycloak-server-spi-private: ECP SAML binding bypasses authentication flows (CVE-2021-3827)

  - Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:5219 advisory.

  - Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:5218 advisory.

  - Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
156792	RHEL 8 : Red Hat Single Sign-On 7.5.1 security update on RHEL 8 (Important) (RHSA-2022:0152)	Nessus	Red Hat Local Security Checks	high
156788	RHEL 7 : Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (Important) (RHSA-2022:0151)	Nessus	Red Hat Local Security Checks	high
156225	RHEL 8 : Red Hat Single Sign-On security update on RHEL 8 (Important) (RHSA-2021:5219)	Nessus	Red Hat Local Security Checks	high
156202	RHEL 7 : Red Hat Single Sign-On 7.5.0 security update on RHEL 7 (Important) (RHSA-2021:5218)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-4133

high

Tenable Plugins

high

high

high

high