~ / search / GHSA-g8q8-fggx-9r3q

GHSA-g8q8-fggx-9r3q

Keycloak vulnerable to path traversal via double URL encoding

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-3782

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-parent < 20.0.2 20.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.

References

External links from the advisory. They lead to third-party sites.