Miggo Logo
Miggo Vulnerability Database
→
GHSA-6mpx-pmgp-ww49

GHSA-6mpx-pmgp-ww49: Duplicate Advisory: Keycloak vulnerable to Cleartext Transmission of Sensitive Information

5.7

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-6mpx-pmgp-ww49
EPSS Score
-
CWE
CWE-319
Published
12/18/2024
Updated
2/5/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.keycloak:keycloak-quarkus-servermaven>= 25.0.0, < 26.0.626.0.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper configuration checks for MTLS encryption in JGroups replication. The first vulnerable function used CACHE_REMOTE_TLS_ENABLED instead of the embedded-specific property (commit 071032a). Later analysis revealed a deeper issue where the configuration system required using Option enums rather than string properties (commit 36defd5). Both instances in different versions of CacheManagerFactory.java failed to properly activate MTLS encryption based on KC_CACHE_EMBEDDED_MTLS_ENABLED, leaving communications unencrypted. The high confidence comes from direct evidence in commit diffs and GHSA documentation linking these code changes to the vulnerability resolution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# *upli**t* **visory T*is **visory **s ***n wit**r*wn ****us* it is * *upli**t* o* **S*-**qq-****-****. T*is link is m*int*in** to pr*s*rv* *xt*rn*l r***r*n**s. # Ori*in*l **s*ription * vuln*r**ility w*s *oun* in K*y*lo*k. T** *nvironm*nt option `K*

Reasoning

T** vuln*r**ility st*mm** *rom improp*r *on*i*ur*tion ****ks *or MTLS *n*ryption in J*roups r*pli**tion. T** *irst vuln*r**l* *un*tion us** *****_R*MOT*_TLS_*N**L** inst*** o* t** *m******-sp**i*i* prop*rty (*ommit *******). L*t*r *n*lysis r*v**l** *