CVE-2023-0264

CWE-287 — Improper AuthenticationCWE-303CWE-3455 documents5 sources
Severity
5.0MEDIUM
EPSS
3.9%
top 11.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Redhat.com KeycloakRedhat KeycloakRedhat Single Sign-on+3 more
Timeline
PublishedAug 4

Description

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.6 | Impact: 3.4

Affected Packages5 packages

▶NVDredhat/keycloak< 18.0.6
▶CVEListV5redhat.com/keycloak18.0.6 — 18.0.6

Also affects: Openshift Container Platform 4.10, 4.9

🔴Vulnerability Details

3
CVEList
CVE-2023-0264: A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests↗2023-08-04
▶
GHSA
Keycloak vulnerable to user impersonation via stolen UUID code↗2023-03-02
▶
OSV
Keycloak vulnerable to user impersonation via stolen UUID code↗2023-03-02
▶

📋Vendor Advisories

1
Red Hat
keycloak: user impersonation via stolen uuid code↗2023-02-28
▶