CVE-2024-10492lowCWE-73

CVE-2024-10492: fallo de gravedad baja en keycloak

Keycloak-quarkus-server: keycloak path trasversal

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat build of Keycloak+ Monitorear Red Hat Single Sign-On

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.7epss 0.7%
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Productos afectados
keycloakRed Hat · Red Hat build of Keycloak 24Red Hat · Red Hat build of Keycloak 24.0.9Red Hat · Red Hat build of Keycloak 26.0Red Hat · Red Hat build of Keycloak 26.0.6Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Single Sign-On 7
CVEs relacionadas — keycloak

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-8883MEDIUMKeycloak: vulnerable redirect uri validation results in open redirecEPSS 2.1%CVE-2024-8698HIGHKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakEPSS 2.0%CVE-2024-1132HIGHKeycloak: path transversal in redirection validationEPSS 1.6%CVE-2024-10270MEDIUMOrg.keycloak:keycloak-services: keycloak denial of serviceEPSS 1.2%CVE-2023-6484MEDIUMKeycloak: log injection during webauthn authentication or registrationEPSS 1.0%