What is GHSA-3qh2-mccc-q5m6?

GHSA-3qh2-mccc-q5m6 is a security advisory published by GitHub Security Advisories with Medium severity. Keycloak Open Redirect

Which CVE IDs does GHSA-3qh2-mccc-q5m6 cover?

GHSA-3qh2-mccc-q5m6 covers the following CVE IDs: CVE-2018-14658. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3qh2-mccc-q5m6?

GHSA-3qh2-mccc-q5m6 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-3qh2-mccc-q5m6?

GHSA-3qh2-mccc-q5m6 affects 1 product, including: maven/org.keycloak:keycloak-core:\u003c= 3.2.1.Final.

GHSA-3qh2-mccc-q5m6MediumCVSS 6.1

Keycloak Open Redirect

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

July 21, 2023

🔗 CVE IDs covered (1)

CVE-2018-14658 →

📋 Description

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

🎯 Affected products1

maven/org.keycloak:keycloak-core:<= 3.2.1.Final

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-14658
https://access.redhat.com/errata/RHSA-2018:3592
https://access.redhat.com/errata/RHSA-2018:3593
https://access.redhat.com/errata/RHSA-2018:3595
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658
https://github.com/advisories/GHSA-3qh2-mccc-q5m6