org.keycloak:keycloak-adapter-core (2.2.0.final), org.keycloak:keycloak-fuse-adapter-dist (2.2.0.final) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.2.0.final)

org.keycloak:keycloak-authz-client MAVEN version 2.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.2.0.final -...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-fuse-adapter-dist (2.5.1.final) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.5.1.final)

org.keycloak:keycloak-authz-client MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final -...

org.keycloak:keycloak-adapter-core (2.2.0.cr1), org.keycloak:keycloak-fuse-adapter-dist (2.2.0.cr1) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.2.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 2.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.2.0.cr1 - org.keycloak:keycloak-fuse-adapter-dist...

org.keycloak:keycloak-adapter-core (2.1.0.cr1), org.keycloak:keycloak-spring-boot-adapter (2.1.0.cr1) +11 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.1.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.1.0.cr1 - org.keycloak:keycloak-spring-boot-adapte...

org.keycloak:keycloak-adapter-core (2.3.0.final), org.keycloak:keycloak-fuse-adapter-dist (2.3.0.final) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.3.0.final)

org.keycloak:keycloak-authz-client MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.3.0.final -...

org.jboss.windup.web:test-authentication-client (>=4.0.0.beta1, <=4.0.1.final), org.keycloak:keycloak-adapter-core (2.1.0.final) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.1.0.final)

org.keycloak:keycloak-authz-client MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.jboss.windup.web:test-authentication-client =4.0.0.beta1, =4.0.1.final -...

org.keycloak:keycloak-adapter-core (2.5.4.final), org.keycloak:keycloak-default-spring-boot-starter (2.5.4.final) +13 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.5.4.final)

org.keycloak:keycloak-authz-client MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.4.final -...

Privilege Escalation

keycloak-spring-boot-adapter is susceptible to privilege escalation attacks. It is due to a flaw in the loop of KeycloakSpringBootConfiguration.java, granting admin access to normal user instead of using the security constraints as intended when Tomcat is used for Spring...