CVE-2020-1698: 
Java vulnerability analysis and mitigation

A flaw was discovered in Keycloak versions before 9.0.0, identified as CVE-2020-1698. The vulnerability involves a logged exception in the HttpMethod class that may leak passwords given as parameters. This security issue was reported in May 2020 and primarily affects the data confidentiality of the system (NVD, Red Hat).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue is classified under CWE-532 (Insertion of Sensitive Information into Log File) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability specifically occurs in the HttpMethod class where exception logging can expose password parameters (NVD).

The primary impact of this vulnerability is on data confidentiality, as it could lead to the exposure of sensitive password information through logged exceptions. The vulnerability has been rated as having a high impact on confidentiality while having no direct impact on system integrity or availability (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L). No user interaction (UI:N) is required to exploit this vulnerability, making it relatively straightforward to exploit if an attacker has the necessary local access (NVD).

The vulnerability was fixed in Keycloak version 9.0.0. Users are advised to upgrade to this version or later to address the security issue. The fix was also included in various Red Hat product updates, including Red Hat build of Thorntail 2.7.0 and Red Hat support for Spring Boot 2.2.6 (Red Hat Advisory).

The vulnerability was acknowledged by Red Hat, and credit for its discovery was given to Tobias Friedrich (Bugzilla).