Headline
GHSA-3w4v-rvc4-2xpw: Keycloak has Files or Directories Accessible to External Parties
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Keycloak has Files or Directories Accessible to External Parties
Moderate severity GitHub Reviewed Published Aug 27, 2022 • Updated Sep 2, 2022
Related news
CVE-2021-3856: [KEYCLOAK-19422] ClassLoaderTheme and ClasspathThemeResourceProviderF… · keycloak/keycloak@73f0474
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.