GHSA-cp67-8w3w-6h9cHighCVSS 7.5

Path Traversal

Published
February 9, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-14366 →

📋 Description

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw

🎯 Affected products1

  • maven/org.keycloak:keycloak-parent:< 12.0.0

🔗 References (3)