PT-2023-2764 · Red Hat · Keycloak

Jordi Zayuelas I Muñoz · Publicado 2023-03-02 · Atualizado 2023-08-14 · CVE-2023-0264

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:A/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-287

CWE-303

CWE-345

Identificadores relacionados

BDU:2023-02654

CVE-2023-0264

GHSA-9G98-5MJ6-F9MV

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Produtos afetados

Keycloak

Referências · 19

• 🔥 https://github.com/twwd/CVE-2023-0264 · Exploit
• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/security/advisories/GHSA-9g98-5mj6-f9mv · Nota
• https://github.com/keycloak/keycloak/commit/ec8109112e67208c13e13f6d1f8706a5a3ba8d4c · Nota
• https://access.redhat.com/security/cve/CVE-2023-0264 · Aviso do Fabricante
• https://github.com/advisories/GHSA-9g98-5mj6-f9mv · Nota
• https://t.me/thebugbountyhunter/7289 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0264 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0264 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02654 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9g98-5mj6-f9mv · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0264 · Nota
• https://t.me/defcon_news/112618 · Publicação no Telegram
• https://t.me/rnetsec/18624 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/8202 · Publicação no Telegram