CVE-2024-3656

Summary

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

Affected Software

Weaknesses

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/
• https://news.ycombinator.com/item?id=42136000
• https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md

References

• https://access.redhat.com/errata/RHSA-2024:3572
• https://access.redhat.com/errata/RHSA-2024:3575
• https://access.redhat.com/security/cve/CVE-2024-3656
• https://bugzilla.redhat.com/show_bug.cgi?id=2274403
• https://github.com/advisories/GHSA-2cww-fgmg-4jqc

• ←Previous
• Next→