CVE-2023-49594

Опубликовано: 23 дек. 2023

Источник: nvd

CVSS3: 4.5

CVSS3: 6.5

EPSS Низкий

Описание

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.

Ссылки

https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8
Release Notes
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1907
Exploit
Third Party Advisory
https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8
Release Notes
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1907
Exploit
Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1907

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:michaelkelly:duouniversalkeycloakauthenticator:*:*:*:*:*:keycloak:*:*

Версия до 1.0.8 (исключая)

EPSS

Процентиль: 29%

0.00103

Низкий

4.5 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-201

NVD-CWE-noinfo

Связанные уязвимости

GHSA-23qf-mx2g-p3gq

CVSS3: 4.5

github

около 2 лет назад

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. An user login to Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.

EPSS

Процентиль: 29%

0.00103

Низкий

4.5 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-201

NVD-CWE-noinfo