Threats Tagged 'ghsa-g77f-483m-m79j'

A vulnerability in the key provider component of the keycloak-services library used by the Red Hat Build of Keycloak allows a realm administrator to submit arbitrary filesystem paths as keystore parameters. This flaw is due to an incomplete fix for path probing and can be exploited to check the existence and readability of files on the server, potentially exposing sensitive information. Exploitation requires high-level privileges (manage-realm role). No official patch or mitigation meeting Red Hat's criteria is currently available.