CVE-2017-2582
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 2.5%
probabilidade de exploração
2.5%top 17% das CVEs
exploração observada
nãonenhuma fonte reporta
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Red Hat · keycloakReferências
https://access.redhat.com/errata/RHSA-2017:2808https://access.redhat.com/errata/RHSA-2017:2809https://access.redhat.com/errata/RHSA-2017:2810https://access.redhat.com/errata/RHSA-2017:2811https://access.redhat.com/errata/RHSA-2017:3216https://access.redhat.com/errata/RHSA-2017:3217https://access.redhat.com/errata/RHSA-2017:3218https://access.redhat.com/errata/RHSA-2017:3219https://access.redhat.com/errata/RHSA-2017:3220https://access.redhat.com/errata/RHSA-2018:2740https://access.redhat.com/errata/RHSA-2018:2741https://access.redhat.com/errata/RHSA-2018:2742