5.7

GHSA-6MPX-PMGP-WW49: keycloak-quarkus-server Maven

CVSS: 5.7v3.1MediumPublished
Published 18-12-2024Last modified 05-02-2025
Open JSON

Vulnerability summary

GHSA-6MPX-PMGP-WW49 is a medium (CVSS 5.7) vulnerability in keycloak-quarkus-server Maven.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
5.7/10
010
Medium · v3.1 (OSV · Maven), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 18-12-2024
    PublishedVulnerability first disclosed.
  2. 05-02-2025
    Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Keycloak vulnerable to Cleartext Transmission of Sensitive Information # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g6qq-c9f9-2772. This link is maintained to preserve external references. # Original Description A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Org.keycloak1 product
  • keycloak-quarkus-server≥ 25.0.0, < 26.0.6

1 vendor · 1 product

References

10 links