GitHub Advisoryadvisory · Maven

GHSA-g8q8-fggx-9r3q Keycloak vulnerable to path traversal via double URL encoding

CRITICAL Published 2022-12-13 Modified 2023-01-25 Official page ↗
Aliases
CVE-2022-3782
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-177, CWE-22
Reviewed
2022-12-13

Affected packages

• Maven org.keycloak:keycloak-parent: < 20.0.2 → fixed in 20.0.2

Description

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.

Related

Alias · CVE (1)

  • CVE-2022-3782 keycloak: path traversal via double URL encoding. vulnerability

Weakness · CWE (2)

  • CWE-177 Improper Handling of URL Encoding (Hex Encoding) weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References