CVE-2024-4540CWE-312

CVE-2024-4540

High · published June 3, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2024-06-03T20:15Z
References (22)
https://access.redhat.com/errata/RHSA-2024:3566 · [email protected]https://access.redhat.com/errata/RHSA-2024:3567 · [email protected]https://access.redhat.com/errata/RHSA-2024:3568 · [email protected]https://access.redhat.com/errata/RHSA-2024:3570 · [email protected]https://access.redhat.com/errata/RHSA-2024:3572 · [email protected]https://access.redhat.com/errata/RHSA-2024:3573 · [email protected]https://access.redhat.com/errata/RHSA-2024:3574 · [email protected]https://access.redhat.com/errata/RHSA-2024:3575 · [email protected]https://access.redhat.com/errata/RHSA-2024:3576 · [email protected]https://access.redhat.com/security/cve/CVE-2024-4540 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2279303 · [email protected]https://access.redhat.com/errata/RHSA-2024:3566 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3567 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3568 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3570 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3572 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3573 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3574 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3575 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3576 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2024-4540 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2279303 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 JUN 15:33Z
    Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
    cvelistv5