Описание
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.
Отчет
Red Hat has evaluated this vulnerability. This affects only Keycloak server and no Keycloak clients library ship the affected code.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Keycloak | org.keycloak-keycloak-parent | Affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | org.keycloak-keycloak-parent | Not affected | ||
| Red Hat Single Sign-On 7 | org.keycloak-keycloak-parent | Affected | ||
| Red Hat Build of Keycloak | Fixed | RHSA-2024:3575 | 03.06.2024 | |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2024:3572 | 03.06.2024 |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin RE ...
Keycloak's admin API allows low privilege users to use administrative functions
Уязвимость прикладного программного интерфейса программного средства для управления идентификацией и доступом Keycloak, позволяющая нарушителю повысить свои привилегии
8.1 High
CVSS3