GHSA-c77r-6f64-478q

    Dashboard / Vulnerabilities / GHSA-c77r-6f64-478q

    GHSA-c77r-6f64-478q

    Published: 18 Oct 2018Last Modified: 16 Feb 2024
    Aliases:
    CVE-2017-2582

    Summary: keycloak-core discloses system properties

    Details: It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-2582, https://github.com/advisories/GHSA-c77r-6f64-478q

    Affected packages

    Package

    Name: org.keycloak:keycloak-core

    Purl: pkg:maven/org.keycloak/keycloak-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.5.1

    Affected versions

    1.0-alpha-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High