Riskcovery

CVE-2024-10492

Keycloak-quarkus-server: keycloak path trasversal

State
Published
Severity
2.7 Low
Published
Nov 25, 2024
Updated
Oct 13, 2026
Reserved
Oct 29, 2024

Read the record on cve.org

Description

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.

Scores

CVSSScoreVectorSource
3.02.7 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nredhat

Weaknesses

  • CWE-73 External Control of File Name or Path

Affected Products

ProductVersions
keycloak
  • before 26.0.6Affected
Red Hat build of Keycloak 24Red Hat
  • 24.0.9-1 and laterNot affected
Red Hat build of Keycloak 24Red Hat
  • 24-18 and laterNot affected
Red Hat build of Keycloak 24Red Hat
  • 24-18 and laterNot affected
Red Hat build of Keycloak 24.0.9Red Hat
    Red Hat build of Keycloak 26.0Red Hat
    • 26.0.6-2 and laterNot affected
    Red Hat build of Keycloak 26.0Red Hat
    • 26.0-5 and laterNot affected
    Red Hat build of Keycloak 26.0Red Hat
    • 26.0-6 and laterNot affected
    Red Hat build of Keycloak 26.0.6Red Hat
      Red Hat JBoss Enterprise Application Platform 8Red Hat
        Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat
          Red Hat Single Sign-On 7Red Hat

            References

            Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.