2.7

GHSA-6VRW-MPJ8-3J59: keycloak-quarkus-server Maven

CVSS: 2.7v3.0LowPublished
Published 25-11-2024Last modified 06-12-2024
Open JSON

Vulnerability summary

GHSA-6VRW-MPJ8-3J59 is a low (CVSS 2.7) vulnerability in keycloak-quarkus-server Maven.

Overall risk
11/100
0100
Low · default modelHow is this calculated?
CVSS score
2.7/10
010
Low · v3.0 (OSV · Maven), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 25-11-2024
    PublishedVulnerability first disclosed.
  2. 06-12-2024
    Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5545-r4hg-rj4m. This link is maintained to preserve external references. ## Original Description A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Org.keycloak1 product
  • keycloak-quarkus-server< 24.0.9 | ≥ 25.0.0, < 26.0.6

1 vendor · 1 product

References

7 links