GHSA-9c24-43p5-fv82

ghsaUSosv

Keycloak code execution via UMA policy abuse

view advisory published 2022-05-24Licence: CC-BY-4.0

A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10169US	high7.2	1.28% (70th)	—	2020-05-08
A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permis…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10169WEB
https://github.com/keycloak/keycloakPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2019-10169ADVISORY
https://security.snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-568797WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan