CVE-2020-14366

Keycloak has a path traversal vulnerability where the resources endpoint maps URL paths to file paths, allowing exposure of limited folder hierarchies via URL-encoded path segments. This is due to a transformation of the URL path to a file path at the resources endpoint. The practical impact stat...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 one-off security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-14366

A flaw was found in keycloak. A path traversal, using URL-encoded path segments in a request, is possible due to transformation of the URL path to a file path at the resource endpoint. The highest threat from this vulnerability is to data confidentiality...

Insufficient Permission Check

keycloak is vulnerable to insufficient permission check.User can manage resources with just "view-profile" role using new Account Console.Allowing access and modification of data the user was not intended to have...

Cross-site Scripting (XSS)

keycloak is vulnerable to cross-site scripting XSS. OIDC redirecturi allows dangerous schemes resulting in potential XSS...

RHEL 7 : Red Hat Single Sign-On 7.4.3 security update on RHEL 7 (Moderate) (RHSA-2020:4930)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4930 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 6 : Red Hat Single Sign-On 7.4.3 security update on RHEL 6 (Moderate) (RHSA-2020:4929)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4929 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 8 : Red Hat Single Sign-On 7.4.3 security update on RHEL 8 (Moderate) (RHSA-2020:4932)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4932 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 8

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 6

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 7

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: path traversal in resources

A flaw was found in keycloak. A path traversal, using URL-encoded path segments in a request, is possible due to transformation of the URL path to a file path at the resource endpoint. The highest threat from this vulnerability is to data confidentiality...