CVE-2021-3856

2022-08-2615:25:39

CWE-552

redhat

www.cve.org

cve-2021-3856

classloadertheme

classpaththemeresourceproviderfactory

reading files

resource

http client

relative path

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.9%

JSON

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

CNA Affected

[
  {
    "product": "keycloak",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 15.1.0"
      }
    ]
  }
]