GHSA-g8q8-fggx-9r3q
Keycloak vulnerable to path traversal via double URL encoding
At a glance
- Published
- Updated
- CVE
- CVE-2022-3782
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-parent | introduced 0, fixed 20.0.2 |
References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-g8q8-fggx-9r3q WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3782 ADVISORY
- https://github.com/keycloak/keycloak/pull/15982/commits/1987c942f527b9f3bbf2a86ba71ba8ae0154ac37 WEB
- https://access.redhat.com/security/cve/CVE-2022-3782 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |