CVE-2024-1132highCWE-22

CVE-2024-1132: falha de alta gravidade em keycloak

Keycloak: path transversal in redirection validation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat build of Keycloak+ Monitorar Red Hat Single Sign-On

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 1.6%
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
keycloakRed Hat · Migration Toolkit for Runtimes 1 on RHEL 8Red Hat · MTA-6.2-RHEL-9Red Hat · Red Hat AMQ Broker 7Red Hat · Red Hat build of Apicurio Registry 2Red Hat · Red Hat build of Keycloak 22Red Hat · Red Hat build of Keycloak 22.0.10Red Hat · Red Hat build of QuarkusRed Hat · Red Hat Data Grid 8Red Hat · Red Hat Decision Manager 7Red Hat · Red Hat Fuse 7Red Hat · Red Hat JBoss Data Grid 7Red Hat · Red Hat JBoss Enterprise Application Platform 6Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat Process Automation 7Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9Red Hat · RHEL-8 based Middleware ContainersRed Hat · RHSSO 7.6.8
CVEs relacionadas — keycloak

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-8698HIGHKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakEPSS 2.0%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-10270MEDIUMOrg.keycloak:keycloak-services: keycloak denial of serviceEPSS 1.2%CVE-2023-4639HIGHUndertow: cookie smuggling/spoofingEPSS 1.1%CVE-2024-1300MEDIUMIo.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportEPSS 1.1%