Description

A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper (Louketo): 6.0.1, 7.0.0

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1770276

https://issues.redhat.com/browse/KEYCLOAK-11318

Related Vulnerabilities

CVE-2022-37264 Vulnerability in npm package steal

CVE-2021-29943 Vulnerability in maven package org.apache.solr:solr-core

CVE-2022-34200 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2023-22621 Vulnerability in npm package @strapi/plugin-email

CVE-2023-48240 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-api

Severity

High

Classification

CWE-601 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Vendor Advisory