CVE-2024-1132
CVE-2024-1132: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.1
High [CVE-2024-1132] path transversal in redirection validation
CVE-2024-1132Source published Source updated
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL. Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution, but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason, Quarkus is marked as having a Low impact. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-22. Affected Red Hat…
- Affected products in this advisory
- Migration Toolkit for Runtimes 1 on RHEL 8
- MTA-6.2-RHEL-9
- Red Hat AMQ Broker 7
- Red Hat build of Keycloak 22.0.10
11 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- mtr/mtr-operator-bundle:1.2-23
- mtr/mtr-rhel8-operator:1.2-15
- mtr/mtr-web-container-rhel8:1.2-16
- mtr/mtr-web-executor-container-rhel8:1.2-14
22 more entries in the full advisory.
- Mitigation guidance
- No current mitigation is available for this vulnerability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.