CVE-2019-14820: Information Exposure

January 8, 2020 (updated January 21, 2020)

It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820
nvd.nist.gov/vuln/detail/CVE-2019-14820

Code Behaviors & Features

Detect and mitigate CVE-2019-14820 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →