CVE-2019-14820

published 2020-01-08

CVE-2019-14820: It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
keycloak	keycloak	—	—
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_enterprise_application_platform	—	—
redhat	jboss_fuse	—	—
redhat	keycloak	< 8.0.0	8.0.0
redhat	single_sign-on	—	—

CWE-200