Maven Package Vulnerabilities
Vulnerabilities associated with org.keycloak:keycloak-core.
Packages
Clear package- org.jenkins-ci.main:jenkins-core257 vulnerabilities
- org.apache.tomcat:tomcat160 vulnerabilities
- com.liferay.portal:release.portal.bom159 vulnerabilities
- com.liferay.portal:release.dxp.bom125 vulnerabilities
- org.keycloak:keycloak-services97 vulnerabilities
- com.fasterxml.jackson.core:jackson-databind80 vulnerabilities
- org.apache.tomcat.embed:tomcat-embed-core74 vulnerabilities
- org.apache.struts:struts2-core60 vulnerabilities
- org.keycloak:keycloak-core50 vulnerabilities
- org.xwiki.platform:xwiki-platform-oldcore46 vulnerabilities
- org.elasticsearch:elasticsearch44 vulnerabilities
- net.mingsoft:ms-mcms39 vulnerabilities
- org.apache.tomcat:tomcat-catalina39 vulnerabilities
- io.undertow:undertow-core38 vulnerabilities
- com.thoughtworks.xstream:xstream37 vulnerabilities
- com.jfinal:jfinal36 vulnerabilities
- org.jenkins-ci.plugins:script-security35 vulnerabilities
- org.apache.solr:solr-core31 vulnerabilities
- org.apache.tomcat:tomcat-coyote31 vulnerabilities
- org.opencms:opencms-core31 vulnerabilities
- org.springframework.security:spring-security-core31 vulnerabilities
- org.eclipse.jetty:jetty-server29 vulnerabilities
- org.bouncycastle:bcprov-jdk1426 vulnerabilities
- org.apache.openmeetings:openmeetings-parent25 vulnerabilities
- org.keycloak:keycloak-parent25 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Keycloak-core: stored xss in keycloak when creating a items in admin consoleA vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack. | CVSS3.8v3.1 | EPSS0.29% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS TerminationA vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism. CWE-295Nov 25, 2024 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Keycloak: amount of attributes per object is not limited and it may lead to dosA denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. CWE-231Sep 10, 2024 | CVSS-v4.0 | EPSS0.736% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverityA vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at … CWE-324Sep 9, 2024 | CVSS-v4.0 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Keycloak-core: open redirect on account pageAn open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.… CWE-601Sep 9, 2024 | CVSS-v4.0 | EPSS0.546% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-6927MEDIUM | Keycloak: open redirect via "form_post.jwt" jarm response modeA flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134. CWE-601Dec 18, 2023 | CVSS4.6v3.1 | EPSS1.11% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-4918HIGH | Plaintext storage of user passwordA flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment. | CVSS8.8v3.1 | EPSS0.466% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1664MEDIUM | Keycloak Untrusted Certificate Validation vulnerabilityA flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not… CWE-295May 26, 2023 | CVSS6.5v3.1 | EPSS0.425% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-0105MEDIUM | Keycloak: Impersonation and lockout possible through incorrect handling of email trustA flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them. | CVSS6.5v3.1 | EPSS0.7% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Keycloak has lack of validation of access token on client registrations endpointA flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information. | CVSS3.8v3.1 | EPSS0.466% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown### Summary A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (16.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown functionality. ### Impact Successful attacks of this vulnerability can result a privileged attacker to load a XSS script, and steal data from other users. The impact can be considered moderate to … CWE-80Nov 29, 2022 | CVSS- | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-0225MEDIUM | Keycloak XSS via use of malicious payload as group name when creating new group from admin consoleA flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack. CWE-79Aug 26, 2022 | CVSS5.4v3.1 | EPSS2.83% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-3632HIGH | Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flowA flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow. CWE-287Aug 26, 2022 | CVSS7.5v3.1 | EPSS0.928% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-3856MEDIUM | Keycloak has Files or Directories Accessible to External PartiesClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available. | CVSS4.3v3.1 | EPSS0.928% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-35509MEDIUM | Keycloak vulnerable to Improper Certificate ValidationA flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. | CVSS5.4v3.1 | EPSS0.303% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-1466MEDIUM | Improper authorization in KeycloakDue to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted. CWE-863Apr 26, 2022 | CVSS6.5v3.1 | EPSS1.07% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-20323MEDIUM | Cross-site Scripting in KeycloakA POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. | CVSS6.1v3.1 | EPSS37.2% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2021-20195CRITICAL | keycloak Self Stored Cross-site Scripting vulnerabilityA flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | CVSS9.6v3.1 | EPSS1.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27826MEDIUM | Authentication Bypass in keycloakA flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application. CWE-250May 28, 2021 | CVSS4.2v3.1 | EPSS0.572% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-20202HIGH | Temporary Directory Hijacking Vulnerability in KeycloakA flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity. CWE-377May 12, 2021 | CVSS7.3v3.1 | EPSS0.299% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-20262MEDIUM | Keycloak Missing authentication for critical functionA flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CWE-306Mar 9, 2021 | CVSS6.8v3.1 | EPSS0.329% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27838MEDIUM | Keycloak discloses information without authenticationA flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. | CVSS6.5v3.1 | EPSS17.9% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2020-10770MEDIUM | Keycloak vulnerable to Server-Side Request ForgeryA flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack. | CVSS5.3v3.1 | EPSS69.7% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2020-14389HIGH | Improper privilege management in KeycloakIt was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have. | CVSS8.1v3.1 | EPSS0.822% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-1714HIGH | Improper Input Validation in KeycloakA flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. CWE-20May 13, 2020 | CVSS8.8v3.1 | EPSS2.6% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |