CVE-2020-1758

low-risk

Published 2020-05-15

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Do I need to act?

0.25% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / HIGH complexity

Affected Products (2)

Keycloak

Openstack

Affected Vendors

Redhat

References (4)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758

Permissions Required https://issues.redhat.com/browse/KEYCLOAK-13285

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758

Permissions Required https://issues.redhat.com/browse/KEYCLOAK-13285

/ 100

low-risk

Severity 17/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 7/34 · Low