Keycloak leaks sensitive information in logged exceptions

GHSA-qgmm-f2qw-r95f · CVE-2020-1698

Published May 24, 2022 · Modified Apr 22, 2024

Description

A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-1698
WEB https://github.com/keycloak/keycloak/pull/6751
WEB https://github.com/keycloak/keycloak/commit/62c9e1577618470832ede22dcedd46cba15b1836
WEB https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes