CVE-2018-14658

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Red Hat	keycloak	3.2.1.Final

References

https://access.redhat.com/errata/RHSA-2018:3592Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3592Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658Issue Tracking, Vendor Advisory

Timeline

Published: Nov 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146596.5The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_K CVE-2018-14665.3IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, CVE-2018-146606.5A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, auth CVE-2018-146616.5It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage,CVE-2018-146625.7It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used CVE-2018-146635.9An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the ad CVE-2018-146645.4A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in CVE-2018-146656.6A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X CVE-2018-146667.2An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host r CVE-2018-146679.8The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unaut CVE-2018-146688.8In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which CVE-2018-146697.5ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database