CVE-2020-10770CWE-918
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri
published December 15, 2020
Patch now
High probability of exploitation
NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.
What it is
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.69724 · 99.4th percentile
- Weakness
- CWE-918 · Server-Side Request Forgery (SSRF)
- Published
- 2020-12-15T00:00Z
EPSS history
Timeline