critical9.1
CVE-2022-3782
Keycloak vulnerable to path traversal via double URL encoding
Impact
Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.keycloak:keycloak-parent | <= 20.0.0 | 20.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Keycloak | Version 20.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2022-3782
- https://github.com/advisories/GHSA-g8q8-fggx-9r3q
- https://github.com/keycloak/keycloak/security/advisories/GHSA-g8q8-fggx-9r3q
- https://github.com/keycloak/keycloak/pull/15982/commits/1987c942f527b9f3bbf2a86ba71ba8ae0154ac37
- https://nvd.nist.gov/vuln/detail/CVE-2022-3782