GCVE - cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Fiware (`1e2da0f0-4513-5714-a01a-f1f210a37b4f`)
Product	Keyrock (`12b9a728-42b9-56ac-953a-89d11fbfa94e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-42167`	vulnerable	2026-06-08 06:43:56.252848	Command Injection in Organisationname CRITICAL (9.1) The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname. Published: 2024-08-12T11:38:35.988Z Updated: 2024-08-12T14:20:39.285Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42166`	vulnerable	2026-06-08 06:43:56.252307	Command Injection in Applicationname CRITICAL (9.1) The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name. Published: 2024-08-12T11:36:28.386Z Updated: 2024-08-12T13:46:39.901Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42165`	vulnerable	2026-06-08 06:43:56.251959	Arbitrary User Activation MEDIUM (6.3) Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link. Published: 2024-08-12T11:33:39.049Z Updated: 2024-08-12T12:23:11.741Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42164`	vulnerable	2026-06-08 06:43:56.251587	Disabling MFA without Authentication MEDIUM (4.3) Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link. Published: 2024-08-12T11:27:17.672Z Updated: 2024-08-12T13:13:06.556Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42163`	vulnerable	2026-06-08 06:43:56.251112	Password Manipulation HIGH (8.3) Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link. Published: 2024-08-12T11:21:54.443Z Updated: 2024-08-12T16:11:16.884Z Open on db.gcve.eu Reference links https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.