Open Redirect Affecting org.keycloak:keycloak-services package, versions [1.0.1.Final,1.0.3.Final)
Threat Intelligence
EPSS
0.08% (38th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-31230
- published 16 Dec 2015
- disclosed 16 Dec 2015
- credit Florian Weimer
Introduced: 16 Dec 2015
CVE-2014-3652 Open this link in a new tabOverview
org.keycloak:keycloak-services
Affected versions of the package are vulnerable to Open Redirect.
It was identified that the login redirect implementation provided by JBoss KeyCloak did not validate the redirect URL. This flaw could be used by a remote attacker to conduct phishing attacks by redirecting users to arbitary websites.
References
CVSS Scores
version 3.1