CVE-2018-14658

Опубликовано: 13 нояб. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 5.8

EPSS Низкий

Описание

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

Ссылки

https://access.redhat.com/errata/RHSA-2018:3592
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658
Issue Tracking
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3592
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:keycloak:3.2.1:*:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.0024

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-601

Связанные уязвимости

CVE-2018-14658

CVSS3: 6.1

redhat

около 7 лет назад

CVE-2018-14658

CVSS3: 6.1

debian

около 7 лет назад

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for b ...

GHSA-3qh2-mccc-q5m6

CVSS3: 6.1

github

больше 3 лет назад

Keycloak Open Redirect

EPSS

Процентиль: 47%

0.0024

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-601