com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17), com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=16.0.0) +74 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=17.0.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.2, =1.2, =0.0.1, =0.0.1, =1.0.7 and more Source cves: CVE-2022-1245 Source advisory: MEND:CVE-2022-1245...

CVE-2022-1245

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to...

CVE-2022-1245

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to...

CVE-2022-1245

CVE-2022-1245 affects Keycloak-based Red Hat Single Sign-On (RH SSO) 7.5.x. The flaw enables privilege escalation via the token-exchange feature where a client with a valid access token can exchange tokens for any target client by supplying its client_id, potentially gaining unauthorized access t...

Moderate: Red Hat Security Advisory: security update for rh-sso-7/sso75-openshift-rhel8 container image

Security updated rh-sso-7/sso75-openshift-rhel8 container image is now available for RHEL-8 based Middleware Containers. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 7

New Red Hat Single Sign-On 7.5.2 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 8

New Red Hat Single Sign-On 7.5.2 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update

A security update is now available for Red Hat Single Sign-On 7.5 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : Red Hat Single Sign-On 7.5.2 security update on RHEL 8 (Moderate) (RHSA-2022:1712)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1712 advisory. Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

org.keycloak:keycloak-authz-policy-drools (6.0.0), org.keycloak:keycloak-dependencies-server-all (6.0.0) +8 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (6.0.0)

org.keycloak:keycloak-services MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 6.0.0 - org.keycloak:keycloak-dependencies-server-all 6.0...

de.adorsys.keycloak:user-secret-adapter-embedded (1.0.7), de.adorsys.keycloak:user-secret-auth-provider (1.0.7) +12 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (7.0.0)

org.keycloak:keycloak-services MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:user-secret-adapter-embedded 1.0.7 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.15), com.github.vzakharchenko:cisco-radius-plugin (1.3.15) +24 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (15.1.0)

org.keycloak:keycloak-services MAVEN version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.15 -...

com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17), com.charlyghislain.keycloak:keycloak-importexport (16.0.0) +30 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (16.1.0)

org.keycloak:keycloak-services MAVEN version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.c4-soft.springaddons:keycloak-grants-mapper =3.1.13-jdk1.8, =1.3.17, =1.3.17, =1.3.17, =1.3.17...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta2), org.keycloak:keycloak-model-jpa (4.0.0.beta2) +2 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (4.0.0.beta2)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta2 - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-account-freemarker (1.1.0.beta2), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta2) +1 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (1.1.0.beta2)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta2 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.11), com.github.vzakharchenko:cisco-radius-plugin (1.3.11) +25 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (15.0.1)

org.keycloak:keycloak-services MAVEN version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.11 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +23 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (14.0.0)

org.keycloak:keycloak-services MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.10), com.github.vzakharchenko:cisco-radius-plugin (1.3.10) +22 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (15.0.0)

org.keycloak:keycloak-services MAVEN version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.10 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.16), com.github.vzakharchenko:cisco-radius-plugin (1.3.16) +24 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (16.0.0)

org.keycloak:keycloak-services MAVEN version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.16 -...

org.keycloak:keycloak-dependencies-server-min (4.8.1.final), org.keycloak:keycloak-model-jpa (4.8.1.final) +2 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (4.8.1.final)

org.keycloak:keycloak-services MAVEN version 4.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.1.final - org.keycloak:keycloak-model-jpa...