Description
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None
Affected Packages2 packages
🔴Vulnerability Details
3OSVPath Traversal↗2022-02-09 GHSAPath Traversal↗2022-02-09 CVEListCVE-2020-14366: A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint↗2020-11-09 💥Exploits & PoCs
2Exploit-DBStock Management System 1.0 - 'brandId and categoriesId' SQL Injection↗2020-10-23 Exploit-DBStock Management System 1.0 - Cross-Site Request Forgery (Change Username)↗2020-09-02 📋Vendor Advisories
1Red Hatkeycloak: path traversal in resources↗2020-11-04 💬Community
1BugzillaCVE-2020-14366 keycloak: path traversal in resources↗2020-08-18