Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

2020-04-1521:08:21

Google

osv.dev

0.001 Low

EPSS

Percentile

23.0%

JSON

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

CPENameOperatorVersion
org.keycloak:keycloak-coreeq2.1.0.Final
org.keycloak:keycloak-coreeq2.4.0.CR1
org.keycloak:keycloak-coreeq2.2.0.Final
org.keycloak:keycloak-coreeq4.0.0.Final
org.keycloak:keycloak-coreeq1.8.0.CR3
org.keycloak:keycloak-coreeq1.2.0.CR1
org.keycloak:keycloak-coreeq1.0-alpha-3
org.keycloak:keycloak-coreeq1.3.0.Final
org.keycloak:keycloak-coreeq1.9.1.Final
org.keycloak:keycloak-coreeq1.1.0.Beta1

Name	Operator	Version
org.keycloak:keycloak-core	eq	2.1.0.Final
org.keycloak:keycloak-core	eq	2.4.0.CR1
org.keycloak:keycloak-core	eq	2.2.0.Final
org.keycloak:keycloak-core	eq	4.0.0.Final
org.keycloak:keycloak-core	eq	1.8.0.CR3
org.keycloak:keycloak-core	eq	1.2.0.CR1
org.keycloak:keycloak-core	eq	1.0-alpha-3
org.keycloak:keycloak-core	eq	1.3.0.Final
org.keycloak:keycloak-core	eq	1.9.1.Final
org.keycloak:keycloak-core	eq	1.1.0.Beta1