Vulnerabilities

TI-2022-03706 CVE-2022-4039 · GHSA-7g6j-5xq2-wgqv

Rhsso-container-image: unsecured management interface exposed to adjecent network

MEDIUM 44

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00789 Published 2023-09-22 Partial fix · 7.6-20 CWE-276

TI-2022-03591 CVE-2022-3916 · GHSA-97g8-xfvw-q4hg

Keycloak: session takeover with oidc offline refreshtokens

LOW 34

A flaw was found in the offline_access scope in Keycloak.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00952 Published 2023-09-20 Fixed in 18.0.3-1.redhat_00002.1.el7sso, 18.0.6-1.redhat_00001.1.el7sso +7 CWE-384

TI-2022-01319 CVE-2022-1438 · GHSA-w354-2f3c-qvg9

Keycloak: xss on impersonation under specific circumstances

LOW 29

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.0066 Published 2023-09-20 Fixed in 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso +2 CWE-79

Vulnerabilities

Filters

Rhsso-container-image: unsecured management interface exposed to adjecent network

Keycloak: session takeover with oidc offline refreshtokens

Keycloak: xss on impersonation under specific circumstances