← CVE Intelligence

CVE-2024-1132

Keycloak: path transversal in redirection validation PUBLISHED

Description (CNA)

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 21.1.0 before 22.0.10; affected 23.0.0 before 24.0.3
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8unaffected 1.2-23 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8unaffected 1.2-15 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8unaffected 1.2-16 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8unaffected 1.2-14 before *
Red Hat / MTA-6.2-RHEL-9unaffected 6.2.3-2 before *
Red Hat / Red Hat AMQ Broker 7unaffected
Red Hat / Red Hat AMQ Broker 7unaffected
Red Hat / Red Hat AMQ Broker 7unaffected
Red Hat / Red Hat build of Keycloak 22unaffected 22.0.10-1 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-13 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-16 before *
Red Hat / Red Hat build of Keycloak 22.0.10unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.13-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.13-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.13-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-46 before *
Red Hat / RHSSO 7.6.8unaffected
Red Hat / Red Hat build of Apicurio Registry 2affected
Red Hat / Red Hat build of Quarkusaffected
Red Hat / Red Hat build of Quarkusaffected
Red Hat / Red Hat Data Grid 8unaffected
Red Hat / Red Hat Decision Manager 7unknown
Red Hat / Red Hat Fuse 7affected
Red Hat / Red Hat JBoss Data Grid 7unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 7unaffected
Red Hat / Red Hat Process Automation 7affected

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.