PT-2024-9013 · Red Hat+1 · Keycloak+1

Published 2024-10-29 · Updated 2026-05-06 · CVE-2024-10492

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Keycloak (affected versions not specified) Red Hat products (affected versions not specified)

Description: A vulnerability was found in Keycloak, allowing a user with high privileges to read sensitive information from a Vault file that is not within the expected context. This requires previous high access to the Keycloak server to perform resource creation. The issue is related to incorrect external management of file names or paths due to incorrect regular expression checking.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-73

CWE-200

Related Identifiers

ALT-PU-2025-13422

ALT-PU-2025-2871

BDU:2024-10695

BDU:2025-02196

CVE-2024-10492

GHSA-5545-R4HG-RJ4M

GHSA-6VRW-MPJ8-3J59

Affected Products

Alt Linux

Keycloak

References · 39

• https://osv.dev/vulnerability/GHSA-6vrw-mpj8-3j59 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:10175 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:10178 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:10177 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:10176 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10695 · Security Note
• https://osv.dev/vulnerability/GHSA-5545-r4hg-rj4m · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-10492 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/pull/35223 · Note
• https://github.com/keycloak/keycloak/issues/35215 · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-5545-r4hg-rj4m · Note
• https://github.com/keycloak/keycloak/commit/d60cb9aaefc4035d322862edd8f9f252af6da951 · Note
• https://twitter.com/transilienceai/status/1861631425444712620 · Twitter Post