CVE-2020-1723 — Open Redirect in Keycloak Gatekeeper

CWE-601 — Open Redirect7 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 63.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Louketo Keycloak GatekeeperKeycloak Gatekeeper Project Keycloak GatekeeperRedhat Mobile Application Platform
Timeline
PublishedJan 28
Latest updateMay 24

Description

A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper (Louketo): 6.0.1, 7.0.0

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5louketo/keycloak_gatekeeper6.0.1, 7.0.0+1

🔴Vulnerability Details

2
GHSA
GHSA-xf65-pwfc-rxcm: The logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to arbitrary web pages↗2022-05-24
▶
CVEList
CVE-2020-1723: A flaw was found in Keycloak Gatekeeper (Louketo)↗2021-01-28
▶

📋Vendor Advisories

1
Red Hat
keycloak: logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to arbitrary web pages↗2021-01-19
▶

💬Community

3
Bugzilla
CVE-2020-25663 ImageMagick: use-after-free, heap-buffer-overflow triggered by GetPixelRed, GetPixelBlue in MagickCore/pixel-accessor.h↗2020-10-26
▶
Bugzilla
CVE-2020-2136 jenkins-git-plugin: stored cross-site scripting↗2020-03-31
▶
Bugzilla
CVE-2020-1723 keycloak: logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to arbitrary web pages↗2019-11-08
▶
CVE-2020-1723 — Open Redirect in Keycloak Gatekeeper | cvebase