CVE-2022-3782

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-378207.8Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ddnsEn parameter in the function formSetSysToolDDNS.CVE-2022-378217.8Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ProvinceCode parameter in the function formSetProvince.CVE-2022-378227.8Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetRouteStatic.CVE-2022-378237.8Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetVirtualSer.CVE-2022-378247.8Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic.CVE-2022-37836.1A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of th CVE-2022-378309.6Interway a.s WebJET CMS 8.6.896 is vulnerable to Cross Site Scripting (XSS).CVE-2022-378329.8Mutiny 7.2.0-10788 suffers from Hardcoded root password.CVE-2022-378357.5Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the s CVE-2022-378399.8TOTOLINK A860R V4.1.2cu.5182_B20201027 is vulnerable to Buffer Overflow via Cstecgi.cgi.CVE-2022-37847.8A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsi CVE-2022-378409.8In TOTOLINK A860R V4.1.2cu.5182_B20201027, the main function in downloadfile.cgi has a buffer overflow vulnerability.