SB2024092017 - Multiple vulnerabilities in Keycloak 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024092017

SB2024092017 - Multiple vulnerabilities in Keycloak

Published: September 20, 2024 Updated: October 14, 2024

Security Bulletin ID SB2024092017
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Open redirect (CVE-ID: CVE-2024-7260)

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data on Account page. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.


2) Improper Authentication (CVE-ID: CVE-2024-7318)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the generated OTP token remains valid longer than its expiration time when using FreeOTP. This increases the attack window for malicious actors to abuse the system and compromise accounts.

Note, the expiration time is 30 seconds, while the token remains valid for 1 minute in total.


Remediation

Install update from vendor's website.

References