GHSA-6xp6-fmc8-pmmr CVE-2021-20202
Temporary Directory Hijacking Vulnerability in Keycloak
- Severity
- 7.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.30%
- Chance of exploitation in the next 30 days. Higher than 22.65% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-377 Insecure Temporary File
- Fix
13.0.0- Upgrade org.keycloak:keycloak-core to this version or later
Description
A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-core | < 13.0.0 |
13.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.keycloak:keycloak-core Maven → 13.0.0
- maven
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-core</artifactId><version>13.0.0</version></dependency>- gradle
implementation("org.keycloak:keycloak-core:13.0.0")
Severity breakdown
CVSS 3.1 7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Weakness
CWE-377: Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q4xq-445g-g6ch Keycloak allows cross-site scripting (XSS) | Low | Also affects org.keycloak:keycloak-core |
| GHSA-93ww-43rr-79v3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination | High | Also affects org.keycloak:keycloak-core |
| GHSA-w97f-w3hq-36g2 Keycloak Denial of Service vulnerability | High | Also affects org.keycloak:keycloak-core |
| GHSA-xmmm-jw76-q7vg Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-g4gc-rh26-m3p5 Keycloak Open Redirect vulnerability | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-9vm7-v8wj-3fqw keycloak-core: open redirect via "form_post.jwt" JARM response mode | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-5q66-v53q-pm35 Keycloak vulnerable to Plaintext Storage of User Password | High | Also affects org.keycloak:keycloak-core |
| GHSA-5cc8-pgp5-7mpm Keycloak Untrusted Certificate Validation vulnerability | Medium | Also affects org.keycloak:keycloak-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor