Local file inclusion In org.keycloak:keycloak-core
Description
Keycloak has Files or Directories Accessible to External Parties ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 15.1.0 | ||
maven | 15.1.0 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.