CVE-2024-1132

Fixed in a distro release EPSS 2%CVSS 8.1

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Published 2024-04-17 · CVE record · OSV

Products: Red Hat Migration Toolkit for Runtimes 1 on RHEL 8, Red Hat MTA-6.2-RHEL-9, Red Hat AMQ Broker 7, Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat RHEL-8 based Middleware Containers, Red Hat RHSSO 7.6.8, Red Hat build of Apicurio Registry 2, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat Process Automation 7

Fixed upstream

Distro releases