En bref
- CVE-2024-2419 est une vulnérabilité ÉLEVÉE (CVSS 7.1) touchant org.keycloak:keycloak-services.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.50%, plus élevée que 42.8% des vulnérabilités.
- Correctif : mettre à jour vers 24.0.3, 22.0.10 ou plus récent.
Description
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
NVD description
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
Autres vulnérabilités de org.keycloak:keycloak-services
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free