Description
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
Remediation
References
https://access.redhat.com/security/cve/CVE-2022-3782
Related Vulnerabilities
CVE-2023-30523 Vulnerability in maven package org.jenkins-ci.plugins:reportportal
CVE-2023-40167 Vulnerability in maven package org.eclipse.jetty:jetty-http
CVE-2014-6439 Vulnerability in maven package org.elasticsearch:elasticsearch
CVE-2019-17359 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15on
CVE-2018-1000610 Vulnerability in maven package io.jenkins:configuration-as-code