GitHub Advisoryadvisory · Maven

GHSA-jh7q-5mwf-qvhw Keycloak vulnerable to Server-Side Request Forgery

MEDIUM Published 2022-05-24 Modified 2022-10-07 Official page ↗
Aliases
CVE-2020-10770
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-601, CWE-918
Reviewed
2022-10-07

Affected packages

• Maven org.keycloak:keycloak-core: < 13.0.0 → fixed in 13.0.0

Description

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter `request_uri`. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

Related

Alias · CVE (1)

  • CVE-2020-10770 A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter… vulnerability

Weakness · CWE (2)

  • CWE-601 URL Redirection to Untrusted Site weakness
  • CWE-918 Server-Side Request Forgery weakness

References