7.1
CVE-2024-2419
- EPSS 0.07%
- Veröffentlicht 17.04.2024 14:15:08
- Zuletzt bearbeitet 21.11.2024 09:09:42
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
LoginDaten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://github.com/keycloak/keycloak
≫
Paket
keycloak
Default Statusunaffected
Version <
22.0.10
Version
0
Status
affected
Version <
24.0.3
Version
23.0.0
Status
affected
HerstellerRed Hat
≫
Produkt
Red Hat build of Keycloak 22
Default Statusaffected
Version <
*
Version
22.0.10-1
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat build of Keycloak 22
Default Statusaffected
Version <
*
Version
22-13
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat build of Keycloak 22
Default Statusaffected
Version <
*
Version
22-16
Status
unaffected
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.213 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| secalert@redhat.com | 7.1 | 2.8 | 3.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
|
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.