CVE-2024-7341highCWE-384

CVE-2024-7341: falha de alta gravidade em org.keycloak:keycloak-services

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat build of Keycloak+ Monitorar Red Hat Single Sign-On

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.8%
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
org.keycloak:keycloak-servicesRed Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of Keycloak 22Red Hat · Red Hat build of Keycloak 24Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat Single Sign-On 7Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9Red Hat · RHEL-8 based Middleware Containers
CVEs relacionadas — org.keycloak:keycloak-services

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2023-5685HIGHXnio: stackoverflowexception when the chain of notifier states becomes problematically bigEPSS 3.5%CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2024-8883MEDIUMKeycloak: vulnerable redirect uri validation results in open redirecEPSS 2.1%