PT-2023-2764 · Red Hat · Keycloak

Jordi Zayuelas I Muñoz · Published 2023-03-02 · Updated 2023-08-14 · CVE-2023-0264

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:A/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Improper Authentication

Weakness Enumeration

CWE-303

CWE-345

CWE-287

Related Identifiers

BDU:2023-02654

CVE-2023-0264

GHSA-9G98-5MJ6-F9MV

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Affected Products

Keycloak

References · 19

• 🔥 https://github.com/twwd/CVE-2023-0264 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0264 · Security Note
• https://access.redhat.com/security/cve/CVE-2023-0264 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0264 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02654 · Security Note
• https://osv.dev/vulnerability/GHSA-9g98-5mj6-f9mv · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-9g98-5mj6-f9mv · Note
• https://github.com/keycloak/keycloak/commit/ec8109112e67208c13e13f6d1f8706a5a3ba8d4c · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0264 · Note
• https://t.me/cybersecuritytechnologies/8202 · Telegram Post
• https://t.me/rnetsec/18624 · Telegram Post
• https://t.me/pentestingnews/36349 · Telegram Post
• https://access.redhat.com/security/cve/cve-2023-0264 · Note
• https://t.me/thebugbountyhunter/7289 · Telegram Post