5.3

CVE-2020-10770: redhat keycloak Server-Side Request Forgery (SSRF)

CVSS: 5.3v3.1MediumModified
AliasesRHSA-2021:0318RHSA-2021:0319RHSA-2021:0320
Published 15-12-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-10770 is a medium (CVSS 5.3) Server-Side Request Forgery (SSRF) vulnerability in redhat keycloak. EPSS estimates a 69.72% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
69.72%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference, exploit-database

Timeline

  1. 15-12-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

69.72%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 69.72% on 21-09-2026

21-09-202621-10-2026
EPSS score
69.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • exploit-databasejavaUnverified

    Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat3 products
  • keycloak< 12.0.2
  • rh-sso7-keycloak< 0:9.0.11-1.redhat_00001.1.el6sso | < 0:9.0.11-1.redhat_00001.1.el7sso | < 0:9.0.11-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server< 0:9.0.11-1.redhat_00001.1.el6sso | < 0:9.0.11-1.redhat_00001.1.el7sso | < 0:9.0.11-1.redhat_00001.1.el8sso
Org.keycloak1 product
  • keycloak-core< 13.0.0

2 vendors · 4 products

References

18 links
Show all 18 references