CVE-2020-10770

Опубликовано: 15 дек. 2020

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Критический

Описание

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

Ссылки

http://packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1846270
Issue Tracking
Vendor Advisory
http://packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1846270
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*

Версия до 12.0.2 (исключая)

EPSS

Процентиль: 100%

0.92282

Критический

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

CVE-2020-10770

CVSS3: 5.8

redhat

около 5 лет назад

CVE-2020-10770

CVSS3: 5.3

debian

около 5 лет назад

A flaw was found in Keycloak before 13.0.0, where it is possible to fo ...

GHSA-jh7q-5mwf-qvhw

CVSS3: 5.3

github

больше 3 лет назад

Keycloak vulnerable to Server-Side Request Forgery

EPSS

Процентиль: 100%

0.92282

Критический

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918