CVE-2021-3513
HIGHKeycloak - Confidentiality Info Disclosure
Title source: llmDescription
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
Scores
CVSS v3
7.5
EPSS
0.0020
EPSS Percentile
42.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Classification
CWE
CWE-522
CWE-209
Status
published
Affected Products (2)
redhat/keycloak
< 13.0.0
org.keycloak/keycloak-parent
< 13.0.0Maven
Timeline
Published
Aug 22, 2022
Tracked Since
Feb 18, 2026