CVE-2019-14820

Published: Jan 8, 2020Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

Affected (5)

Products: Redhat: Keycloak, Single Sign On, Jboss Enterprise Application Platform, Jboss Fuse

4 products

Jboss Enterprise Application Platform

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Keycloak	Before 8.0.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Single Sign On	Version 7.3

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.4.0
Redhat Jboss Enterprise Application Platform	Version 7.2.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Fuse	Version 7.0.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.