CVE-2024-1132highCWE-22

Keycloak: path transversal in redirection validation

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 1.6%

probabilidade de exploração

1.6%top 26% das CVEs

exploração observada

nãonenhuma fonte reporta

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Produtos afetados

keycloakRed Hat · Migration Toolkit for Runtimes 1 on RHEL 8 Red Hat · MTA-6.2-RHEL-9 Red Hat · Red Hat AMQ Broker 7 Red Hat · Red Hat build of Apicurio Registry 2 Red Hat · Red Hat build of Keycloak 22 Red Hat · Red Hat build of Keycloak 22.0.10 Red Hat · Red Hat build of Quarkus Red Hat · Red Hat Data Grid 8 Red Hat · Red Hat Decision Manager 7 Red Hat · Red Hat Fuse 7 Red Hat · Red Hat JBoss Data Grid 7 Red Hat · Red Hat JBoss Enterprise Application Platform 6 Red Hat · Red Hat JBoss Enterprise Application Platform 7 Red Hat · Red Hat Process Automation 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9 Red Hat · RHEL-8 based Middleware Containers Red Hat · RHSSO 7.6.8

Referências