VULNERABILITY INTELLIGENCE

CVE-2020-1758

CVSS score5.3 MEDIUM

EPSS probability0.93%

CISA KEVNot currently listed

Published2020-05-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Weakness classification

secalert@redhat.com: CWE-297
nvd@nist.gov: CWE-295

Primary references

secalert@redhat.com — Issue Tracking, Vendor Advisory
secalert@redhat.com — Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory