CVE-2018-14658: Medium severity red hat keycloak vulnerability
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
Other sources
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verfied. This can lead to an Open Redirection attack
— Red Hat
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14658?
CVE-2018-14658 is classified as a medium severity vulnerability that may lead to an Open Redirection attack.
How do I fix CVE-2018-14658?
To fix CVE-2018-14658, upgrade to Keycloak version 4.6.0 or later.
Which versions of Keycloak are affected by CVE-2018-14658?
CVE-2018-14658 affects Keycloak version 3.2.1.Final and earlier versions.
What type of vulnerability is CVE-2018-14658?
CVE-2018-14658 is an Open Redirection vulnerability due to improper URL normalization.
Is CVE-2018-14658 exploitable remotely?
Yes, CVE-2018-14658 can be exploited remotely by attackers through manipulated redirect URLs.