keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NRed Hat Keycloak
APPRedhat20.0.2
Powiązane podatności
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerabili...
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows ...
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a comple...
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail serve...
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS ...