CVE-2024-3656CWE-200information-disclosure

CVE-2024-3656

High · published October 9, 2024

CVSS v3.1
8.1
EPSS
3%
Percentile
88.5
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.03323 · 88.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-10-09T23:15Z
References (8)
https://access.redhat.com/errata/RHSA-2024:3572 · [email protected]https://access.redhat.com/errata/RHSA-2024:3575 · [email protected]https://access.redhat.com/security/cve/CVE-2024-3656 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2274403 · [email protected]https://github.com/advisories/GHSA-2cww-fgmg-4jqc · [email protected]https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md · af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=42136000 · af854a3a-2127-422b-91ae-364da2661108https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 OCT 18:59Z
    Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities
    cvelistv5