GHSA-qgmm-f2qw-r95f

ghsaUSosv

Keycloak leaks sensitive information in logged exceptions

view advisory published 2022-05-24Licence: CC-BY-4.0

A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1698US	medium5.5	0.37% (31st)	—	2020-05-11
A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerabili…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698WEB
https://github.com/keycloak/keycloak/commit/62c9e1577618470832ede22dcedd46cba15b1836WEB
https://github.com/keycloak/keycloak/pull/6751WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1698ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan