GHSA-5545-r4hg-rj4m

Source

https://github.com/advisories/GHSA-5545-r4hg-rj4m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-5545-r4hg-rj4m/GHSA-5545-r4hg-rj4m.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-5545-r4hg-rj4m

Aliases

CVE-2024-10492

Related

Published

2024-11-25T18:37:14Z

Modified

2024-11-25T18:57:16.287387Z

Severity

2.7 (Low) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

Details

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-73"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-25T18:37:14Z"
}

References

Affected packages

Maven / org.keycloak:keycloak-quarkus-server

Package

Name: org.keycloak:keycloak-quarkus-server; View open source insights on deps.dev
Purl: pkg:maven/org.keycloak/keycloak-quarkus-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

26.0.6

Affected versions

12.*

12.0.0

12.0.1

12.0.2

12.0.3

12.0.4

13.*

13.0.0

13.0.1

14.*

14.0.0

15.*

15.0.0

15.0.1

15.0.2

15.1.0

15.1.1

16.*

16.0.0

16.1.0

16.1.1

17.*

17.0.0

17.0.1

18.*

18.0.0

18.0.1

18.0.2

19.*

19.0.0

19.0.1

19.0.2

19.0.3

20.*

20.0.0

20.0.1

20.0.2

20.0.3

20.0.4

20.0.5

21.*

21.0.0

21.0.1

21.0.2

21.1.0

21.1.1

21.1.2

22.*

22.0.0

22.0.1

22.0.2

22.0.3

22.0.4

22.0.5

23.*

23.0.0

23.0.1

23.0.2

23.0.3

23.0.4

23.0.5

23.0.6

23.0.7

24.*

24.0.0

24.0.1

24.0.2

24.0.3

24.0.4

24.0.5

25.*

25.0.0

25.0.1

25.0.2

25.0.3

25.0.4

25.0.5

25.0.6

26.*

26.0.0

26.0.1

26.0.2

26.0.4

26.0.5

Database specific

{
    "last_known_affected_version_range": "< 24.0.9"
}