GitHub Advisoryadvisory · Maven

GHSA-cp67-8w3w-6h9c Path Traversal

HIGH Published 2022-02-09 Modified 2021-04-01 Official page ↗
Aliases
CVE-2020-14366
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2021-04-01

Affected packages

• Maven org.keycloak:keycloak-parent: < 12.0.0 → fixed in 12.0.0

Description

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw

Related

Alias · CVE (1)

  • CVE-2020-14366 A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References