← Back

CVE-2024-0560

nvd nist
Published: Feb 28, 2024Modified: Jan 21, 2025

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

Affected (1)

Products: Redhat: 3scale
Redhat
1 product
3scale
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
3scale
All versions
Running on/withPlatform Versions
Redhat
Keycloak
Version 15.0.0

Related CWEs

CWE-280
Improper Handling of Insufficient Permissions or Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

References (6)

Source: secalert@redhat.com
MitigationVendor Advisory
Source: secalert@redhat.com
MitigationVendor Advisory
Source: secalert@redhat.com
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch

Timeline

No history available yet.