Medium Oak-core CVEs
28 CVEs, 1 exploited, 1 protected by Waratek
Overview 28 matches · 1 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
1
3.6%
Rule in development
0
0.0%
Mitigation candidate
3
10.7%
No exploit published
24
85.7%
blocked by ARMR today
1
3.6%
partly blocked
0
0.0%
not blocked
27
96.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
3.6%
Working exploit published
2
7.1%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
25
89.3%
split by
peak 8 / year
20185
No exploit published5
Medium5
not blocked5
No public exploit5
20192
No exploit published2
Medium2
not blocked2
No public exploit2
20208
Mitigation candidate1
No exploit published7
Medium8
not blocked8
Exploited1
No public exploit7
20213
Mitigation candidate1
No exploit published2
Medium3
not blocked3
Working exploit published1
No public exploit2
20225
Protected by Waratek1
Mitigation candidate1
No exploit published3
Medium5
blocked by ARMR today1
not blocked4
Working exploit published1
No public exploit4
20233
No exploit published3
Medium3
not blocked3
No public exploit3
20242
No exploit published2
Medium2
not blocked2
No public exploit2
2018201920202021202220232024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-7318 | Medium | 2024-09-09 | No exploit published | No public exploit | A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid. |
| CVE-2024-7260 | Medium | 2024-09-09 | No exploit published | No public exploit | An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain. |
| CVE-2023-6927 | Medium | 2023-12-18 | No exploit published | No public exploit | A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134. |
| CVE-2023-1664 | Medium | 2023-05-26 | No exploit published | No public exploit | A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable. |
| CVE-2023-0105 | Medium | 2023-01-13 | No exploit published | No public exploit | A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them. |
| CVE-2022-0225 | Medium | 2022-08-26 | No exploit published | No public exploit | A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack. |
| CVE-2021-3856 | Medium | 2022-08-26 | Protected by Waratek | No public exploit | ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available. |
| CVE-2020-35509 | Medium | 2022-08-23 | No exploit published | No public exploit | A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. |
| CVE-2022-1466 | Medium | 2022-04-26 | No exploit published | No public exploit | Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted. |
| CVE-2021-20323 | Medium | 2022-03-25 | Mitigation candidate | Working exploit published | A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. |
| CVE-2020-27826 | Medium | 2021-05-28 | No exploit published | No public exploit | A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application. |
| CVE-2021-20262 | Medium | 2021-03-09 | No exploit published | No public exploit | A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. |
| CVE-2020-27838 | Medium | 2021-03-08 | Mitigation candidate | Working exploit published | A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. |
| CVE-2020-10770 | Medium | 2020-12-15 | Mitigation candidate | Exploited | A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack. |
| CVE-2020-1724 | Medium | 2020-05-11 | No exploit published | No public exploit | A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section. |
| CVE-2020-1698 | Medium | 2020-05-11 | No exploit published | No public exploit | A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality. |
| CVE-2020-10686 | Medium | 2020-05-04 | No exploit published | No public exploit | A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users. |
| CVE-2020-1728 | Medium | 2020-04-06 | No exploit published | No public exploit | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors. |
| CVE-2020-1744 | Medium | 2020-03-24 | No exploit published | No public exploit | A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events. |
| CVE-2020-1697 | Medium | 2020-02-10 | No exploit published | No public exploit | It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks. |
| CVE-2019-14820 | Medium | 2020-01-08 | No exploit published | No public exploit | It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information. |
| CVE-2014-3656 | Medium | 2019-12-10 | No exploit published | No public exploit | JBoss KeyCloak: XSS in login-status-iframe.html |
| CVE-2019-3875 | Medium | 2019-06-12 | No exploit published | No public exploit | A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle. |
| CVE-2018-14658 | Medium | 2018-11-13 | No exploit published | No public exploit | A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack |
| CVE-2017-2582 | Medium | 2018-07-26 | No exploit published | No public exploit | It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. |
| CVE-2018-10912 | Medium | 2018-07-23 | No exploit published | No public exploit | keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server. |
| CVE-2017-2585 | Medium | 2018-03-12 | No exploit published | No public exploit | Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. |
| CVE-2016-8629 | Medium | 2018-03-12 | No exploit published | No public exploit | Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm. |