Keycloak's admin API allows low privilege users to use administrative functions

高 8.1CVE-2024-3656 · GHSA-2cww-fgmg-4jqc · 09/10/2024 公開 · 09/10/2026 更新

要点

CVE-2024-3656 は org.keycloak:keycloak-services に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.3%（全脆弱性の 88.6% より高い）。
対処：24.0.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-services Maven	`< 24.0.5`	`24.0.5`

概要

Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

NVD の説明

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.