Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01NTQ1LXI0aGctcmo0bc4ABBva

Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.

Permalink: https://github.com/advisories/GHSA-5545-r4hg-rj4m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01NTQ1LXI0aGctcmo0bc4ABBva
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 15 days ago
Updated: 15 days ago

CVSS Score: 2.7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00044
EPSS Percentile: 0.11709

Identifiers: GHSA-5545-r4hg-rj4m, CVE-2024-10492
References:

• https://github.com/keycloak/keycloak/security/advisories/GHSA-5545-r4hg-rj4m
• https://nvd.nist.gov/vuln/detail/CVE-2024-10492
• https://github.com/keycloak/keycloak/issues/35215
• https://github.com/keycloak/keycloak/commit/d60cb9aaefc4035d322862edd8f9f252af6da951
• https://access.redhat.com/errata/RHSA-2024:10175
• https://access.redhat.com/errata/RHSA-2024:10176
• https://access.redhat.com/errata/RHSA-2024:10177
• https://access.redhat.com/errata/RHSA-2024:10178
• https://access.redhat.com/security/cve/CVE-2024-10492
• https://bugzilla.redhat.com/show_bug.cgi?id=2322447
• https://github.com/advisories/GHSA-5545-r4hg-rj4m

Repository: https://github.com/keycloak/keycloak
Blast Radius: 3.8

Affected Packages