CVE-2024-4540
Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.55 % · centile 46 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Deferred
Description
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Faiblesses (CWE)
- CWE-312 — Stockage en clair d'informations sensibles
Références
- https://access.redhat.com/errata/RHSA-2024:3566
- https://access.redhat.com/errata/RHSA-2024:3567
- https://access.redhat.com/errata/RHSA-2024:3568
- https://access.redhat.com/errata/RHSA-2024:3570
- https://access.redhat.com/errata/RHSA-2024:3572
- https://access.redhat.com/errata/RHSA-2024:3573
- https://access.redhat.com/errata/RHSA-2024:3574
- https://access.redhat.com/errata/RHSA-2024:3575
- https://access.redhat.com/errata/RHSA-2024:3576
- https://access.redhat.com/security/cve/CVE-2024-4540
- https://bugzilla.redhat.com/show_bug.cgi?id=2279303
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
Avis
- GHSA-69fp-7c8p-crjr — Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
Références européennes
- ENISA EUVD · EUVD-2024-1945
- GCVE · GCVE-0-2024-4540
Produits affectés
| Produit | Versions |
|---|---|
| keycloak | unaffected d5e82356f90893ca3b308a7e10020103e402369a < * |
| Red Hat · Red Hat Build of Keycloak | |
| Red Hat · Red Hat Build of Keycloak | |
| Red Hat · Red Hat build of Keycloak 22 | unaffected 22.0.11-2 < * |
| Red Hat · Red Hat build of Keycloak 22 | unaffected 22-15 < * |
| Red Hat · Red Hat build of Keycloak 22 | unaffected 22-18 < * |
| Red Hat · Red Hat build of Keycloak 24 | unaffected 24.0.5-2 < * |
| Red Hat · Red Hat build of Keycloak 24 | unaffected 24-10 < * |
| Red Hat · Red Hat build of Keycloak 24 | unaffected 24-10 < * |
| Red Hat · Red Hat Single Sign-On 7 | |
| Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7 | unaffected 0:18.0.14-1.redhat_00001.1.el7sso < * |
| Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8 | unaffected 0:18.0.14-1.redhat_00001.1.el8sso < * |
| Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9 | unaffected 0:18.0.14-1.redhat_00001.1.el9sso < * |
| Red Hat · RHEL-8 based Middleware Containers | unaffected 7.6-49 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |