CVE-2019-14820 Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Attackers can access unauthorized information by invoking exposed internal adapter endpoints via specially crafted URLs in Keycloak.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14820?
CVE-2019-14820 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 8 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Weakness: CWE-200
Which versions are affected by CVE-2019-14820?
2 open source packages ship an affected version, including org.keycloak:keycloak-core. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-core Maven | All versions | 8.0.0 |
org.keycloak:keycloak-core Maven | All versions | 8.0.0 |
Linux distribution packages (10)
keycloak-adapter-sso7_3-eap6 Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:4.8.13-1.Final_redhat_00001.1.ep6.el6 |
keycloak-saml-adapter-sso7_3-eap6 Red Hat:jboss_enterprise_application_platform:6::el6 | All versions | 0:4.8.13-1.Final_redhat_00001.1.ep6.el6 |
keycloak-adapter-sso7_3-eap6 Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:4.8.13-1.Final_redhat_00001.1.ep6.el7 |
keycloak-saml-adapter-sso7_3-eap6 Red Hat:jboss_enterprise_application_platform:6::el7 | All versions | 0:4.8.13-1.Final_redhat_00001.1.ep6.el7 |
eap7-keycloak-adapter-sso7_3 Red Hat:jboss_enterprise_application_platform:7.2::el6 | All versions | 0:4.8.13-1.Final_redhat_00001.1.el6eap |
eap7-keycloak-saml-adapter-sso7_3 Red Hat:jboss_enterprise_application_platform:7.2::el6 | All versions | 0:4.8.13-1.Final_redhat_00001.1.el6eap |
eap7-keycloak-adapter-sso7_3 Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:4.8.13-1.Final_redhat_00001.1.el7eap |
eap7-keycloak-saml-adapter-sso7_3 Red Hat:jboss_enterprise_application_platform:7.2::el7 | All versions | 0:4.8.13-1.Final_redhat_00001.1.el7eap |
eap7-keycloak-adapter-sso7_3 Red Hat:jboss_enterprise_application_platform:7.2::el8 | All versions | 0:4.8.13-1.Final_redhat_00001.1.el8eap |
eap7-keycloak-saml-adapter-sso7_3 Red Hat:jboss_enterprise_application_platform:7.2::el8 | All versions | 0:4.8.13-1.Final_redhat_00001.1.el8eap |
Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Fuse, Redhat Keycloak, Redhat Single Sign-On.
How do I fix CVE-2019-14820?
Upgrade org.keycloak:keycloak-core to 8.0.0 or later.
Is CVE-2019-14820 being exploited?
There is no known exploitation of CVE-2019-14820 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-xfqh-7356-vqjj, RHSA-2019:3048, RHSA-2019:3049.