Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-3w4v-rvc4-2xpw: Keycloak has Files or Directories Accessible to External Parties

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

ghsa
#git#ssl

Keycloak has Files or Directories Accessible to External Parties

Moderate severity GitHub Reviewed Published Aug 27, 2022 • Updated Sep 2, 2022

Related news

CVE-2021-3856: [KEYCLOAK-19422] ClassLoaderTheme and ClasspathThemeResourceProviderF… · keycloak/keycloak@73f0474

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.