CVE-2024-7341
published 2024-09-09CVE-2024-7341: A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even…
PriorityP333high7.1CVSS 3.1
AVNACHPRLUIRSUCHIHAH
EPSS
0.80%
52.5th percentile
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 22.0 < 22.0.12 | 22.0.12 |
| redhat | build_of_keycloak | >= 24.0 < 24.0.7 | 24.0.7 |
| redhat | keycloak | <= 25.0.2 | — |
| redhat | single_sign-on | >= 7.6 < 7.6.10 | 7.6.10 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Keycloak has session fixation in Elytron SAML adapters
osv·2024-10-14
CVE-2024-7341 [HIGH] Keycloak has session fixation in Elytron SAML adapters
Keycloak has session fixation in Elytron SAML adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
GHSA
Keycloak has session fixation in Elytron SAML adapters
ghsa·2024-10-14
CVE-2024-7341 [HIGH] CWE-384 Keycloak has session fixation in Elytron SAML adapters
Keycloak has session fixation in Elytron SAML adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Red Hat
wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
vendor_redhat·2024-09-09·CVSS 7.1
CVE-2024-7341 [HIGH] CWE-384 wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Statement: This vulnerability is categorized as
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2024:6493https://access.redhat.com/errata/RHSA-2024:6494https://access.redhat.com/errata/RHSA-2024:6495https://access.redhat.com/errata/RHSA-2024:6497https://access.redhat.com/errata/RHSA-2024:6499https://access.redhat.com/errata/RHSA-2024:6500https://access.redhat.com/errata/RHSA-2024:6501https://access.redhat.com/errata/RHSA-2024:6502https://access.redhat.com/errata/RHSA-2024:6503https://access.redhat.com/security/cve/CVE-2024-7341https://bugzilla.redhat.com/show_bug.cgi?id=2302064https://github.com/advisories/GHSA-j76j-rqwj-jmvv
2024-09-09
Published