CVE-2020-10770

🗓️ 15 Dec 2020 00:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 259 Views🌐 WEB

A flaw in Keycloak before 13.0.0 allows SSRF attack via OIDC parameter

Reporter	Title	Published	Views	Family All 37
0day.today	Keycloak 12.0.1 - (request_uri) Blind Server-Side Request Forgery (Unauthenticated) Exploit	13 Oct 202100:00	–	zdt
ATTACKERKB	CVE-2023-44469	29 Sep 202307:15	–	attackerkb
Circl	CVE-2020-10770	15 Dec 202022:40	–	circl
CNNVD	红帽 Red Hat Keycloak 代码问题漏洞	26 Nov 202000:00	–	cnnvd
CNVD	Red Hat Keycloak Server-Side Request Forgery Vulnerability	27 Nov 202000:00	–	cnvd
Cvelist	CVE-2020-10770	15 Dec 202000:00	–	cvelist
GithubExploit	Exploit for Server-Side Request Forgery in Redhat Keycloak	13 Oct 202108:40	–	githubexploit
Exploit DB	Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)	13 Oct 202100:00	–	exploitdb
Github Security Blog	Keycloak vulnerable to Server-Side Request Forgery	24 May 202217:36	–	github
Hacker One	MTN Group: SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ci	23 Oct 202103:13	–	hackerone

NVD

Vulners

Node

redhat keycloakRange<12.0.2

[
  {
    "vendor": "n/a",
    "product": "keycloak",
    "versions": [
      {
        "version": "keycloak 13.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
packetstormsecurity	www.packetstormsecurity.com/files/164499/Keycloak-12.0.1-Server-Side-Request-Forgery.html

Parameter	Position	Path	Description	CWE
request_uri	query param	/auth/realms/master/protocol/openid-connect/auth	Keycloak SSRF via unverified request_uri parameter in OpenID Connect auth flow	CWE-918

21 Nov 2024 04:56Current

4.9Medium risk

Vulners AI Score4.9

CVSS 25

CVSS 3.15.3

EPSS0.92282