6.1
Medium
CVE-2018-14658 A flaw was found in JBOSS Keycloak 3.2.1.Final
Description
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak | 3.2.1.Final | No fix stated |
References
- bugzilla.redhat.com bugzilla.redhat.com
- RHSA-2018:3592 access.redhat.com
- RHSA-2018:3593 access.redhat.com
- RHSA-2018:3595 access.redhat.com
Timeline
- Published
- Last modified
Other CVEs of keycloak
The 22 CVEs of keycloak →
CVE-2020-14366
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible…
6.8
Medium
CVE-2020-1758
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while…
5.3
Medium
CVE-2020-1714
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…
7.5
High
CVE-2020-1718
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0
7.1
High