PT-2024-17571 · Red Hat+1 · Eap 7.X+2

Olivier Rivat · Published 2024-12-09 · Updated 2026-01-26 · CVE-2024-12369

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OIDC-Client versions prior to the fixed version EAP 7.x EAP 8.x

Description A vulnerability was found in OIDC-Client, allowing authorization code injection attacks to occur when using the RH SSO OIDC adapter with EAP 7.x or the elytron-oidc-client subsystem with EAP 8.x. This enables an attacker to inject a stolen authorization code into their own session with the client, impersonating a victim's identity, typically through a Man-in-the-Middle (MitM) or phishing attack.

Recommendations For OIDC-Client, update to a version that includes the fix for this issue. For EAP 7.x, consider disabling the RH SSO OIDC adapter until a patch is available. For EAP 8.x, restrict access to the elytron-oidc-client subsystem to minimize the risk of exploitation. As a temporary workaround, consider implementing additional security measures to detect and prevent Man-in-the-Middle (MitM) or phishing attacks.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-12369

GHSA-4V5X-9M47-CQR2

GHSA-5565-3C98-G6JC

RHSA-2025:3989

RHSA-2025:3990

Affected Products

Eap 7.X

Eap 8.X

Oidc-Client

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2024-12369 · Security Note
• https://access.redhat.com/errata/RHSA-2025:3989 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:3990 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:3992 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4v5x-9m47-cqr2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5565-3c98-g6jc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12369 · Vendor Advisory
• https://github.com/wildfly/wildfly · Note
• https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb · Note
• https://github.com/wildfly-security/wildfly-elytron/pull/2261 · Note
• https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb · Note
• https://github.com/wildfly-security/wildfly-elytron/pull/2253 · Note
• https://github.com/wildfly-security/wildfly-elytron · Note
• https://github.com/wildfly-security/wildfly-elytron/security/advisories/GHSA-5565-3c98-g6jc · Note
• https://access.redhat.com/security/cve/CVE-2024-12369 · Note