CVE-2024-1248: The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation…

PriorityP430medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.30%

21.5th percentile

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator.

Affected

26 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_manager	>= 3.0.0 < 3.0.0.153	3.0.0.153
wso2	api_manager	>= 3.1.0 < 3.1.0.267	3.1.0.267
wso2	api_manager	>= 3.2.0 < 3.2.0.351	3.2.0.351
wso2	api_manager	>= 4.0.0 < 4.0.0.269	4.0.0.269
wso2	api_manager	>= 4.1.0 < 4.1.0.169	4.1.0.169
wso2	identity_server	>= 5.10.0 < 5.10.0.284	5.10.0.284
wso2	identity_server	>= 5.11.0 < 5.11.0.321	5.11.0.321
wso2	identity_server	>= 5.8.0 < 5.8.0.101	5.8.0.101
wso2	identity_server	>= 5.9.0 < 5.9.0.138	5.9.0.138
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.280	5.10.0.280
wso2	identity_server_as_key_manager	>= 5.9.0 < 5.9.0.148	5.9.0.148
wso2	open_banking_am	>= 2.0.0 < 2.0.0.313	2.0.0.313
wso2	open_banking_iam	>= 2.0.0 < 2.0.0.333	2.0.0.333
wso2	wso2_api_manager	>= 3.0.0 < 3.0.0.153	3.0.0.153
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.267	3.1.0.267
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.351	3.2.0.351
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.269	4.0.0.269
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.169	4.1.0.169
wso2	wso2_identity_server	>= 5.10.0 < 5.10.0.284	5.10.0.284
wso2	wso2_identity_server	>= 5.11.0 < 5.11.0.321	5.11.0.321
wso2	wso2_identity_server	>= 5.8.0 < 5.8.0.101	5.8.0.101
wso2	wso2_identity_server	>= 5.9.0 < 5.9.0.138	5.9.0.138
wso2	wso2_identity_server_as_key_manager	>= 5.10.0 < 5.10.0.280	5.10.0.280
wso2	wso2_identity_server_as_key_manager	>= 5.9.0 < 5.9.0.148	5.9.0.148
wso2	wso2_open_banking_am	>= 2.0.0 < 2.0.0.313	2.0.0.313

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.