org.keycloak:keycloak-dependencies-server-all (7.0.1), org.keycloak:keycloak-saml-adapter-api-public (7.0.1) +23 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (7.0.1)

org.keycloak:keycloak-saml-core MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 7.0.1 - org.keycloak:keycloak-saml-adapter-api-publ...

org.keycloak:keycloak-broker-saml (1.3.1.final), org.keycloak:keycloak-dependencies-server-all (1.3.1.final) +1 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (1.3.1.final)

org.keycloak:keycloak-saml-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-broker-saml 1.3.1.final - org.keycloak:keycloak-dependencies-server-a...

org.keycloak:keycloak-dependencies-server-all (11.0.3), org.keycloak:keycloak-saml-adapter-api-public (11.0.3) +24 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (11.0.3)

org.keycloak:keycloak-saml-core MAVEN version 11.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 11.0.3 -...

org.keycloak:keycloak-broker-saml (1.6.1.final), org.keycloak:keycloak-dependencies-server-all (1.6.1.final) +19 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (1.6.1.final)

org.keycloak:keycloak-saml-core MAVEN version 1.6.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-broker-saml 1.6.1.final - org.keycloak:keycloak-dependencies-server-a...

org.keycloak:keycloak-broker-saml (1.8.0.cr3), org.keycloak:keycloak-dependencies-server-all (1.8.0.cr3) +19 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (1.8.0.cr3)

org.keycloak:keycloak-saml-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-broker-saml 1.8.0.cr3 - org.keycloak:keycloak-dependencies-server-all...

org.keycloak:keycloak-dependencies-server-all (2.3.0.final), org.keycloak:keycloak-saml-adapter-api-public (2.3.0.final) +21 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (2.3.0.final)

org.keycloak:keycloak-saml-core MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 2.3.0.final -...

org.keycloak:keycloak-dependencies-server-all (9.0.3), org.keycloak:keycloak-saml-adapter-api-public (9.0.3) +23 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (9.0.3)

org.keycloak:keycloak-saml-core MAVEN version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 9.0.3 - org.keycloak:keycloak-saml-adapter-api-publ...

org.keycloak:keycloak-broker-saml (1.5.0.final), org.keycloak:keycloak-dependencies-server-all (1.5.0.final) +1 more potentially affected by CVE-2021-3827 via org.keycloak:keycloak-saml-core (1.5.0.final)

org.keycloak:keycloak-saml-core MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-broker-saml 1.5.0.final - org.keycloak:keycloak-dependencies-server-a...

Information Disclosure

keycloak-saml-core is vulnerable to sensitive information disclosure. The attack exists because SAML messages are being parsed by replacing the string to obtain the attribute values with the system property in StaxParserUtil class. Therefore, attacker can just parse the chosen system property nam...