CVE-2024-3656

nvd nist nuclei

Published: Oct 9, 2024Modified: Jun 17, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

https://access.redhat.com/errata/RHSA-2024:3572

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:3575

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2024-3656

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2274403

Source: secalert@redhat.com

https://github.com/advisories/GHSA-2cww-fgmg-4jqc

Source: secalert@redhat.com

https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md

Source: af854a3a-2127-422b-91ae-364da2661108

https://news.ycombinator.com/item?id=42136000

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.