GitHub Advisoryadvisory · Maven
GHSA-5545-r4hg-rj4m Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
MEDIUM
Official page ↗
- Aliases
- CVE-2024-10492
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-quarkus-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-73
- Reviewed
- 2024-11-25
Affected packages
• Maven org.keycloak:keycloak-quarkus-server: < 26.0.6 → fixed in 26.0.6
• Maven org.keycloak:keycloak-quarkus-server: >= 25.0.0, < 26.0.6 → fixed in 26.0.6
Description
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
Related
Alias · CVE (1)
- CVE-2024-10492 A vulnerability was found in Keycloak. vulnerability
Weakness · CWE (1)
- CWE-73 External Control of File Name or Path weakness
References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-5545-r4hg-rj4m web
- https://nvd.nist.gov/vuln/detail/CVE-2024-10492 advisory
- https://github.com/keycloak/keycloak/issues/35215 web
- https://github.com/keycloak/keycloak/commit/d60cb9aaefc4035d322862edd8f9f252af6da951 web
- https://access.redhat.com/errata/RHSA-2024:10175 web
- https://access.redhat.com/errata/RHSA-2024:10176 web
- https://access.redhat.com/errata/RHSA-2024:10177 web
- https://access.redhat.com/errata/RHSA-2024:10178 web
- https://access.redhat.com/security/cve/CVE-2024-10492 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2322447 web
- https://github.com/keycloak/keycloak package