org.keycloak:keycloak-core@18.0.1 vulnerabilities
latest version
26.4.0
latest non vulnerable version
first published
11 years ago
latest version published
24 days ago
licenses detected
- [1.0-alpha-1,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.keycloak:keycloak-core package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Environmental Variables through user-configurable URLs. Exploiting this vulnerability is possible with the configuration of backchannel logout URLs or admin URLs, when including placeholders like How to fix Exposure of Sensitive Information Through Environmental Variables? Upgrade | [,26.0.8) |
org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to the extended validation period of How to fix Use of a Key Past its Expiration Date? Upgrade | [,24.0.7)[25.0.0,25.0.4) |
org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Improper Handling of Extra Values due to the lack of limitation on the number of attributes per object. An attacker can cause resource exhaustion by sending repeated HTTP requests that result in the application sending back rows with long attribute values. How to fix Improper Handling of Extra Values? Upgrade | [0,24.0.0) |
org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Unprotected Transport of Credentials for the LDAP testing endpoint, which allows the modification of the How to fix Unprotected Transport of Credentials? Upgrade | [,24.0.6)[25.0.0,25.0.1) |
org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The ”Groups” dropdown in ”Add user” is not escaped properly. It allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console. How to fix Cross-site Scripting (XSS)? Upgrade | [16.0.1,20.0.0) |
org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Improper Certificate Validation due to allowing unintended access of an untrusted certificate when using How to fix Improper Certificate Validation? Upgrade | [0,21.1.2) |