WaratekVRT Sign in

Redhat Migration Toolkit CVEs

5 CVEs, 1 exploited, 1 protected by Waratek

Reset
More filters (2)
Columns
Vendor redhat✕Product migration toolkit✕
Overview 5 matches · 1 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
5matches 1protected20.0% 1exploited20.0% 1CISA KEV20.0% 1public PoC20.0% 1EPSS ≥ 0.520.0%
Protected by Waratek 1 20.0% Rule in development 0 0.0% Mitigation candidate 1 20.0% No exploit published 3 60.0%
Critical 0 0.0% High 4 80.0% Medium 1 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 0 0.0% not blocked 4 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 20.0% Working exploit published 0 0.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 1 / month
No exploit published: 3Mitigation candidate: 1Protected by Waratek: 1 Medium: 1High: 4 not blocked: 4blocked by ARMR today: 1 No public exploit: 3Proof of concept only: 1Exploited: 1
Feb 231 No exploit published1 High1 not blocked1 No public exploit1 Mar 230 Apr 230 May 231 No exploit published1 Medium1 not blocked1 No public exploit1 Jun 230 Jul 230 Aug 230 Sep 230 Oct 231 Mitigation candidate1 High1 not blocked1 Exploited1 Nov 230 Dec 230 Jan 241 No exploit published1 High1 not blocked1 No public exploit1 Feb 240 Mar 240 Apr 241 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1
Feb 23Apr 23Jun 23Aug 23Oct 23Dec 23Feb 24Apr 24
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-1132 High 2024-04-17 Protected by Waratek Proof of concept only A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
CVE-2023-6291 High 2024-01-26 No exploit published No public exploit A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-1664 Medium 2023-05-26 No exploit published No public exploit A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable.
CVE-2022-4492 High 2023-02-23 No exploit published No public exploit The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.