Information Exposure Affecting org.keycloak:keycloak-services package, versions [0,20.0.3)
Threat Intelligence
EPSS
0.05% (22nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-6230716
- published 7 Feb 2024
- disclosed 28 Oct 2022
- credit Sourav Kumar
Introduced: 28 Oct 2022
CVE-2023-0091 Open this link in a new tabHow to fix?
Upgrade org.keycloak:keycloak-services to version 20.0.3 or higher.
Overview
org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.
Affected versions of this package are vulnerable to Information Exposure due to not properly checking client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.
References
CVSS Scores
version 3.1