CVE-2024-10973CWE-319

CVE-2024-10973

Medium · published December 18, 2024

CVSS v3.1
5.7
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2024-12-18T04:15Z
References (2)
https://access.redhat.com/security/cve/CVE-2024-10973 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2324361 · [email protected]
EPSS history
Timeline
  • 17 DEC 22:59Z
    Keycloak: cli option for encrypted jgroups ignored
    cvelistv5