org.keycloak:keycloak-authz-client@5.0.0 vulnerabilities
latest version
26.0.3
first published
8 years ago
latest version published
2 months ago
licenses detected
- [2.0.0.CR1,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.keycloak:keycloak-authz-client package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.keycloak:keycloak-authz-client is a client API for Keycloak Authz. Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Environmental Variables through user-configurable URLs. Exploiting this vulnerability is possible with the configuration of backchannel logout URLs or admin URLs, when including placeholders like How to fix Exposure of Sensitive Information Through Environmental Variables? Upgrade | [0,26.0.8) |
org.keycloak:keycloak-authz-client is a client API for Keycloak Authz. Affected versions of this package are vulnerable to Remote Code Execution (RCE). A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application. How to fix Remote Code Execution (RCE)? Upgrade | [,8.0.0) |
org.keycloak:keycloak-authz-client is the client API for Keycloak Authz. Affected versions of this package are vulnerable to Information Exposure.
A flaw was found in keycloak where a logged exception in the How to fix Information Exposure? Upgrade | [,9.0.0) |