Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2017-2582

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-c77r-6f64-478q

keycloak-core discloses system properties It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

gitlab/maven/org.keycloak/keycloak-core/CVE-2017-2582

Exposure of Sensitive Information to an Unauthorized Actor It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

gitlab/npm/keycloak-connect/CVE-2017-2582

Information Exposure It was found that while parsing the SAML messages the `StaxParserUtil` class of keycloak replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request `ID` field to be the chosen system property which could be obtained in the `InResponseTo` field in the response.