Log in Start free

Vulnerability · Published Jun 3, 2024 · Assigned by redhat

CVE-2024-4540Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie

High 7.5

In plain English

A high-severity security flaw in keycloak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-services24.0.5GHSA-69fp-7c8p-crjr

Affected products (as reported)

VendorProductVersions
keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat build of Keycloak 22 see references
Red Hat Red Hat build of Keycloak 22 see references
Red Hat Red Hat build of Keycloak 22 see references
Red Hat Red Hat build of Keycloak 24 see references
Red Hat Red Hat build of Keycloak 24 see references
Red Hat Red Hat build of Keycloak 24 see references
Red Hat Red Hat Single Sign-On 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 see references
Red Hat RHEL-8 based Middleware Containers see references

Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References