CVE-2021-3856

Katalog CVE

CVSS 4.3 · Medium EPSS 1,1%

Kerentanan Files or Directories Accessible to External Parties pada redhat keycloak. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

Rincian

Terbit di NVD

26 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-3856 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2010164 issue tracking · advisory vendor
• https://issues.redhat.com/browse/KEYCLOAK-19422 permissions required · advisory vendor
• https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743 patch · advisory pihak ketiga
• https://github.com/keycloak/keycloak/pull/8588 patch · advisory pihak ketiga