IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.1Yüksek

CVE-2024-1132Keycloak: path transversal in redirection validation

keycloak; Red Hat Migration Toolkit for Runtimes 1 on RHEL 8; Red Hat MTA-6.2-RHEL-9; Red Hat Red Hat AMQ Broker 7 Yayım: (2 yıl önce)

Açıklama

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Zayıflık türü (CWE): CWE-22

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
build keycloak 22 —
migration toolkit applications 6.2 —
migration toolkit runtimes 1.0 —
redhat build of keycloak —
redhat jboss middleware text-only advisories 1.0
redhat keycloak 21.1.0 – < 22.0.10
redhat migration toolkit for applications 1.0
redhat migration toolkit for runtimes —
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 all versions
Red Hat MTA-6.2-RHEL-9 all versions
redhat openshift container platform 4.11
redhat openshift container platform for ibm z 4.9
redhat openshift container platform for linuxone 4.9
redhat openshift container platform for power 4.9
Red Hat Red Hat AMQ Broker 7 —
Red Hat Red Hat build of Apicurio Registry 2 all versions
Red Hat Red Hat build of Keycloak 22 all versions
Red Hat Red Hat build of Keycloak 22.0.10 —
Red Hat Red Hat build of Quarkus all versions
Red Hat Red Hat Data Grid 8 —
Red Hat Red Hat Decision Manager 7 —
Red Hat Red Hat Fuse 7 all versions
Red Hat Red Hat JBoss Data Grid 7 —
Red Hat Red Hat JBoss Enterprise Application Platform 6 —
Red Hat Red Hat JBoss Enterprise Application Platform 7 —
Red Hat Red Hat Process Automation 7 all versions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 all versions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 all versions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 all versions
Red Hat RHEL-8 based Middleware Containers all versions
Red Hat RHSSO 7.6.8 —
redhat single sign-on 7.6
red hat single sign on 7.6 —
rhosemc 1.0 —
— keycloak 21.1.0 – < 22.0.10, 23.0.0 – < 24.0.3

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (16)
  • cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*
  • cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* ≥ 21.1.0 < 22.0.10
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* ≥ 23.0.0 < 24.0.3
  • cpe:2.3:a:redhat:migration_toolkit_for_applications:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
  • cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*