PT-2024-38263 · Red Hat · Keycloak

Patrick Del Bello + 1 · Published 2024-09-09 · Updated 2024-10-14 · CVE-2024-7318

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A vulnerability was found in Keycloak where expired OTP codes are still usable when using FreeOTP with the default OTP token period of 30 seconds. Instead of expiring after 30 seconds, the tokens remain valid for an additional 30 seconds, totaling 1 minute. This increases the attack window for malicious actors to abuse the system and compromise accounts, as well as the attack surface, since two OTPs are valid at any given time.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-324

Related Identifiers

CVE-2024-7318

GHSA-57RH-GR4V-J5F6

GHSA-XMMM-JW76-Q7VG

Affected Products

Keycloak

References · 16

• https://access.redhat.com/errata/RHSA-2024:6503 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7318 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2301876 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2024-7318 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57rh-gr4v-j5f6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmmm-jw76-q7vg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7318 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg · Note
• https://twitter.com/VulmonFeeds/status/1833243722395369676 · Twitter Post
• https://t.me/cvenotify/95457 · Telegram Post
• https://t.me/cvedetector/5121 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7318 · Note
• https://t.me/cvenotify/93947 · Telegram Post