PT-2024-11925 · Red Hat · Keycloak

Chess Hazlett · Published 2024-04-17 · Updated 2024-11-18 · CVE-2023-0657

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Authentication Bypass by Spoofing

Improper Verification of Cryptographic Signature

Improper Authentication

Weakness Enumeration

CWE-284

CWE-273

CWE-290

CWE-347

CWE-287

Related Identifiers

CVE-2023-0657

GHSA-7FPJ-9HR8-28VH

Affected Products

Keycloak

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-0657 · Security Note
• https://access.redhat.com/errata/RHSA-2024:1868 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1867 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7fpj-9hr8-28vh · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-7fpj-9hr8-28vh · Note
• https://t.me/cvenotify/101937 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2166728 · Note
• https://t.me/cvedetector/11257 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1858142589104398804 · Twitter Post
• https://twitter.com/CVEnew/status/1858096932381458551 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2023-0657 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0657 · Note