CVE-2022-1970
Keycloak Open Redirect
Description
Rejected reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to mitigate the issue: https://www.keycloak.org/docs/latest/server_admin/index.html#open-redirectors.
INFO
Published Date :
Oct. 19, 2022, 6:15 p.m.
Last Modified :
May 29, 2024, 2:15 a.m.
Remotely Exploit :
No
Source :
[email protected]
Public PoC/Exploit Available at Github
CVE-2022-1970 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Vulnerabilities you my miss during a penetration testing.
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-1970 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-1970 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
May. 29, 2024
Action Type Old Value New Value Removed Translation Title: KeyCloak 18.0.0 Description: KeyCloak 18.0.0: Abre la redirección en el punto final de autenticación a través del parámetro redirect_uri. -
CVE Modified by [email protected]
May. 29, 2024
Action Type Old Value New Value Changed Description keycloak 18.0.0: open redirect in auth endpoint via the redirect_uri parameter. Rejected reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to mitigate the issue: https://www.keycloak.org/docs/latest/server_admin/index.html#open-redirectors. Removed Reference Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2022-1970 Removed Reference Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2092434 Removed CWE NIST CWE-601 Removed CWE Red Hat, Inc. CWE-601 Removed CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Removed CVSS V3.1 Red Hat, Inc. AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N Removed CPE Configuration OR *cpe:2.3:a:redhat:keycloak:18.0.0:*:*:*:*:*:*:* -
CVE Rejected by [email protected]
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
CVE Source Update by [email protected]
Nov. 07, 2023
Action Type Old Value New Value Changed Source MITRE Red Hat, Inc. -
CVE Modified by [email protected]
Nov. 07, 2023
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2022-1970 [No types assigned] Added Reference Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2092434 [No types assigned] Removed Reference MITRE https://bugzilla.redhat.com/show_bug.cgi?id=2092434 Removed Reference MITRE https://access.redhat.com/security/cve/CVE-2022-1970 Added CWE Red Hat, Inc. CWE-601 Removed CVSS V3.1 MITRE AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N Added CVSS V3.1 Red Hat, Inc. AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N -
Initial Analysis by [email protected]
Feb. 16, 2023
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Changed Reference Type https://access.redhat.com/security/cve/CVE-2022-1970 No Types Assigned https://access.redhat.com/security/cve/CVE-2022-1970 Vendor Advisory Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2092434 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=2092434 Issue Tracking, Vendor Advisory Added CWE NIST CWE-601 Added CPE Configuration OR *cpe:2.3:a:redhat:keycloak:18.0.0:*:*:*:*:*:*:* -
CVE Modified by [email protected]
Feb. 12, 2023
Action Type Old Value New Value Changed Description ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none. keycloak 18.0.0: open redirect in auth endpoint via the redirect_uri parameter. Added CVSS V3.1 MITRE AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2092434 [No Types Assigned] Added Reference https://access.redhat.com/security/cve/CVE-2022-1970 [No Types Assigned] -
CVE Unrejected by [email protected]
Feb. 12, 2023
Action Type Old Value New Value -
CVE Rejected by [email protected]
Oct. 19, 2022
Action Type Old Value New Value