CVE-2018-14658
MEDIUMCVSS 6.1/10EPSS 1.10%
Last modified
CVE-2018-14658 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. EPSS estimates a 1.10% chance of exploitation in the next 30 days.
Description
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Keycloak | 3.2.1 |
References
- https://access.redhat.com/errata/RHSA-2018:3592Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:3593Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:3595Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:3592Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:3593Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:3595Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-14658?
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
How severe is CVE-2018-14658?
CVE-2018-14658 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 1.10% probability of exploitation in the next 30 days.
How do I fix CVE-2018-14658?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-14652The Gluster file system through versions 3.12 and 4.1.4 is v…6.5
- CVE-2018-14653The Gluster file system through versions 4.1.4 and 3.12 is v…8.8
- CVE-2018-14654The Gluster file system through version 4.1.4 is vulnerable …6.5
- CVE-2018-14655A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0…4.6
- CVE-2018-14656A missing address check in the callers of the show_opcodes()…7
- CVE-2018-14657A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When …8.1
- CVE-2018-14659The Gluster file system through versions 4.1.4 and 3.1.2 is …6.5
- CVE-2018-1466IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtua…5.3
- CVE-2018-14660A flaw was found in glusterfs server through versions 4.1.4 …6.5
- CVE-2018-14661It was found that usage of snprintf function in feature/lock…6.5
- CVE-2018-14662It was found Ceph versions before 13.2.4 that authenticated …5.7
- CVE-2018-14663An issue has been found in PowerDNS DNSDist before 1.3.3 all…5.9
Are you affected by CVE-2018-14658?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST