Количество 5
Количество 5
CVE-2017-2582
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
CVE-2017-2582
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
CVE-2017-2582
It was found that while parsing the SAML messages the StaxParserUtil c ...
GHSA-c77r-6f64-478q
keycloak-core discloses system properties
BDU:2019-00225
Уязвимость класса StaxParserUtil программного обеспечения Picketlink для управления безопасностью и идентификацией приложений Java, позволяющая нарушителю раскрыть защищаемую информацию
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2017-2582 It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. | CVSS3: 6.5 | 1% Низкий | больше 8 лет назад |
 | CVE-2017-2582 It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. | CVSS3: 6.5 | 1% Низкий | больше 7 лет назад |
| CVE-2017-2582 It was found that while parsing the SAML messages the StaxParserUtil c ... | CVSS3: 6.5 | 1% Низкий | больше 7 лет назад |
| GHSA-c77r-6f64-478q keycloak-core discloses system properties | CVSS3: 6.5 | 1% Низкий | больше 7 лет назад |
 | BDU:2019-00225 Уязвимость класса StaxParserUtil программного обеспечения Picketlink для управления безопасностью и идентификацией приложений Java, позволяющая нарушителю раскрыть защищаемую информацию | CVSS3: 6.5 | 1% Низкий | больше 8 лет назад |
Уязвимостей на страницу