{"api_version":"1","generated_at":"2026-07-23T11:38:02+00:00","cve":"CVE-2020-1758","urls":{"html":"https://cve.report/CVE-2020-1758","api":"https://cve.report/api/cve/CVE-2020-1758.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-1758","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-1758"},"summary":{"title":"CVE-2020-1758","description":"A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2020-05-15 19:15:00","updated_at":"2023-11-07 03:19:00"},"problem_types":["CWE-295"],"metrics":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758","refsource":"CONFIRM","tags":["Issue Tracking","Vendor Advisory"],"title":"1812514 – (CVE-2020-1758) CVE-2020-1758 keycloak: improper verification of certificate with host mismatch could result in information disclosure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://issues.redhat.com/browse/KEYCLOAK-13285","name":"https://issues.redhat.com/browse/KEYCLOAK-13285","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"Login server redirect","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1758","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1758","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"1758","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"keycloak","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1758","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"keycloak","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1758","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openstack","cpe6":"10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"1758","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openstack","cpe6":"10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-1758","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Red Hat","product":{"product_data":[{"product_name":"keycloak","version":{"version_data":[{"version_value":"keycloak versions before 10.0.0"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-297"}]}]},"references":{"reference_data":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758","refsource":"CONFIRM"},{"url":"https://issues.redhat.com/browse/KEYCLOAK-13285","refsource":"MISC","name":"https://issues.redhat.com/browse/KEYCLOAK-13285"}]},"description":{"description_data":[{"lang":"eng","value":"A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack."}]},"impact":{"cvss":[[{"vectorString":"5.3/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.0"}]]}},"nvd":{"publishedDate":"2020-05-15 19:15:00","lastModifiedDate":"2023-11-07 03:19:00","problem_types":["CWE-295"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.2,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"1758","Ordinal":"160996","Title":"CVE-2020-1758","CVE":"CVE-2020-1758","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"1758","Ordinal":"1","NoteData":"A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"1758","Ordinal":"2","NoteData":"2020-05-15","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"1758","Ordinal":"3","NoteData":"2020-05-15","Type":"Other","Title":"Modified"}]}}}