GHSA-3w4v-rvc4-2xpwMediumCVSS 4.3

Keycloak has Files or Directories Accessible to External Parties

Published
August 27, 2022
Last Modified
July 11, 2023

🔗 CVE IDs covered (1)

CVE-2021-3856 →

📋 Description

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

🎯 Affected products1

  • maven/org.keycloak:keycloak-core:< 15.1.0

🔗 References (7)