Red Hat Security AdvisoryRHSA-2019:3048
RH-SSO 7.3.4 adapters for Enterprise Application Platform 6 security update
Released 2019-10-14 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server keycloak-adapter-sso7_3-eap6-4.8.13-1.Final_redhat_00001.1.ep6.el6, keycloak-saml-adapter-sso7_3-eap6-4.8.13-1.Final_redhat_00001.1.ep6.el6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server keycloak-adapter-sso7_3-eap6-4.8.13-1.Final_redhat_00001.1.ep6.el7, keycloak-saml-adapter-sso7_3-eap6-4.8.13-1.Final_redhat_00001.1.ep6.el7
Fixes 1 record
Priority LOW 21
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00717 · Published 2020-01-08 · Partial fix · 8.0.0 CWE-200
