Vulnerability-Lookup - Search a vulnerability

cve-2023-1932

Vulnerability from cvelistv5

Published

2024-11-07 10:00

Modified

2024-11-07 14:09

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

References

▼	URL	Tags
	https://access.redhat.com/security/cve/CVE-2023-1932	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=1809444	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

A-MQ Clients 2

cpe:/a:redhat:a_mq_clients:2

Red Hat	Cryostat 2	cpe:/a:redhat:cryostat:2
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat A-MQ Online	cpe:/a:redhat:amq_online:1
Red Hat	Red Hat BPM Suite 6	cpe:/a:redhat:jboss_enterprise_bpms_platform:6
Red Hat	Red Hat CodeReady Studio 12	cpe:/a:redhat:jboss_developer_studio:12.
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss BRMS 5	cpe:/a:redhat:jboss_enterprise_brms_platform:5
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Data Virtualization 6	cpe:/a:redhat:jboss_data_virtualization:6
Red Hat	Red Hat JBoss Enterprise Application Platform 5	cpe:/a:redhat:jboss_enterprise_application_platform:5
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Continuous Delivery	cpe:/a:redhat:jboss_enterprise_application_platform_cd
Red Hat	Red Hat JBoss Fuse 6	cpe:/a:redhat:jboss_fuse:6
Red Hat	Red Hat JBoss Fuse Service Works 6	cpe:/a:redhat:jboss_fuse_service_works:6
Red Hat	Red Hat JBoss Operations Network 3	cpe:/a:redhat:jboss_operations_network:3
Red Hat	Red Hat JBoss SOA Platform 5	cpe:/a:redhat:jboss_enterprise_soa_platform:5
Red Hat	Red Hat OpenStack Platform 10 (Newton)	cpe:/a:redhat:openstack:10
Red Hat	Red Hat OpenStack Platform 13 (Queens)	cpe:/a:redhat:openstack:13
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7
Red Hat	Red Hat support for Spring Boot	cpe:/a:redhat:openshift_application_runtimes:1.0
Red Hat	streams for Apache Kafka	cpe:/a:redhat:amq_streams:1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-1932",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-07T14:09:13.280925Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-79",
                        description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-07T14:09:26.936Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:a_mq_clients:2",
               ],
               defaultStatus: "unaffected",
               packageName: "org.apache.logging.log4j-log4j",
               product: "A-MQ Clients 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:cryostat:2",
               ],
               defaultStatus: "unaffected",
               packageName: "hibernate-validator",
               product: "Cryostat 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7",
               ],
               defaultStatus: "unaffected",
               packageName: "hibernate-validator",
               product: "Red Hat AMQ Broker 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_online:1",
               ],
               defaultStatus: "unaffected",
               packageName: "io.enmasse-enmasse",
               product: "Red Hat A-MQ Online",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat BPM Suite 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_developer_studio:12.",
               ],
               defaultStatus: "affected",
               packageName: "hibernate-validator",
               product: "Red Hat CodeReady Studio 12",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "hibernate-validator",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:5",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss BRMS 5",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_virtualization:6",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Data Virtualization 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:5",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Enterprise Application Platform 5",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform_cd",
               ],
               defaultStatus: "affected",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:6",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Fuse 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse_service_works:6",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Fuse Service Works 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_operations_network:3",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss Operations Network 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_soa_platform:5",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat JBoss SOA Platform 5",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openstack:10",
               ],
               defaultStatus: "unknown",
               packageName: "opendaylight",
               product: "Red Hat OpenStack Platform 10 (Newton)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openstack:13",
               ],
               defaultStatus: "affected",
               packageName: "opendaylight",
               product: "Red Hat OpenStack Platform 13 (Queens)",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:satellite:6",
               ],
               defaultStatus: "affected",
               packageName: "candlepin",
               product: "Red Hat Satellite 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "affected",
               packageName: "hibernate-validator",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_application_runtimes:1.0",
               ],
               defaultStatus: "unknown",
               packageName: "hibernate-validator",
               product: "Red Hat support for Spring Boot",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_streams:1",
               ],
               defaultStatus: "unaffected",
               packageName: "hibernate-validator",
               product: "streams for Apache Kafka",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Christian Kistner (SySS GmbH) and Moritz Bechler (SySS GmbH) for reporting this issue.",
            },
         ],
         datePublic: "2024-02-07T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-07T10:00:51.745Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-1932",
            },
            {
               name: "RHBZ#1809444",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1809444",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2020-02-27T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-02-07T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-1932",
      datePublished: "2024-11-07T10:00:51.745Z",
      dateReserved: "2023-04-06T20:10:01.569Z",
      dateUpdated: "2024-11-07T14:09:26.936Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-1249

Vulnerability from cvelistv5

Published

2024-04-17 13:22

Modified

2025-03-26 19:24

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Summary

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:1860	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1864	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1867	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1868	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2945	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:4057	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-1249	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2262918	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 21.1.0 ≤
Version: 23.0.0 ≤

Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7.12
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22.0.10-1 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-13 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-16 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22.0.10	cpe:/a:redhat:build_keycloak:22
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	Unaffected: 0:18.0.13-1.redhat_00001.1.el7sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	Unaffected: 0:18.0.13-1.redhat_00001.1.el8sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	Unaffected: 0:18.0.13-1.redhat_00001.1.el9sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.6-46 < * cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-3 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHSSO 7.6.8	cpe:/a:redhat:red_hat_single_sign_on:7.6
Red Hat	Migration Toolkit for Applications 6	cpe:/a:redhat:migration_toolkit_applications:6
Red Hat	Migration Toolkit for Applications 7	cpe:/a:redhat:migration_toolkit_applications:7
Red Hat	Red Hat build of Apicurio Registry 2	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Developer Hub	cpe:/a:redhat:rhdh:1
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	streams for Apache Kafka	cpe:/a:redhat:amq_streams:1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-1249",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-25T17:33:02.839974Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T18:00:28.545Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T18:33:25.533Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:1860",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1860",
               },
               {
                  name: "RHSA-2024:1861",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1861",
               },
               {
                  name: "RHSA-2024:1862",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1862",
               },
               {
                  name: "RHSA-2024:1864",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1864",
               },
               {
                  name: "RHSA-2024:1866",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1866",
               },
               {
                  name: "RHSA-2024:1867",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1867",
               },
               {
                  name: "RHSA-2024:1868",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1868",
               },
               {
                  name: "RHSA-2024:2945",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:2945",
               },
               {
                  name: "RHSA-2024:4057",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:4057",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2024-1249",
               },
               {
                  name: "RHBZ#2262918",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2262918",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/keycloak/keycloak",
               defaultStatus: "unaffected",
               packageName: "keycloak",
               versions: [
                  {
                     lessThan: "22.0.10",
                     status: "affected",
                     version: "21.1.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.0.3",
                     status: "affected",
                     version: "23.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7.12",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat AMQ Broker 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-operator-bundle",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22.0.10-1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9-operator",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-16",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat build of Keycloak 22.0.10",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.13-1.redhat_00001.1.el7sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.13-1.redhat_00001.1.el8sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.13-1.redhat_00001.1.el9sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhosemc:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso-7/sso76-openshift-rhel8",
               product: "RHEL-8 based Middleware Containers",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "7.6-46",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-data-index-ephemeral-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-data-index-postgresql-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-jobs-service-postgresql-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-operator-bundle",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-rhel8-operator",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-3",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-swf-builder-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-swf-devmode-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "RHSSO 7.6.8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:6",
               ],
               defaultStatus: "affected",
               packageName: "mta/mta-ui-rhel9",
               product: "Migration Toolkit for Applications 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:7",
               ],
               defaultStatus: "unaffected",
               packageName: "mta/mta-ui-rhel9",
               product: "Migration Toolkit for Applications 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat build of Apicurio Registry 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhdh:1",
               ],
               defaultStatus: "unaffected",
               packageName: "rhdh/rhdh-hub-rhel9",
               product: "Red Hat Developer Hub",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_2-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_3-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_4-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_5-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "org.keycloak-keycloak-parent",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_streams:1",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "streams for Apache Kafka",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Adriano Márcio Monteiro for reporting this issue.",
            },
         ],
         datePublic: "2024-04-16T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Keycloak's OIDC component in the \"checkLoginIframe,\" which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-346",
                     description: "Origin Validation Error",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-26T19:24:12.590Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:1860",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1860",
            },
            {
               name: "RHSA-2024:1861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1861",
            },
            {
               name: "RHSA-2024:1862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1862",
            },
            {
               name: "RHSA-2024:1864",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1864",
            },
            {
               name: "RHSA-2024:1866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1866",
            },
            {
               name: "RHSA-2024:1867",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1867",
            },
            {
               name: "RHSA-2024:1868",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1868",
            },
            {
               name: "RHSA-2024:2945",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2945",
            },
            {
               name: "RHSA-2024:4057",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:4057",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-1249",
            },
            {
               name: "RHBZ#2262918",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2262918",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-02-06T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-04-16T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-346: Origin Validation Error",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-1249",
      datePublished: "2024-04-17T13:22:48.335Z",
      dateReserved: "2024-02-06T06:20:24.574Z",
      dateUpdated: "2025-03-26T19:24:12.590Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-1415

Vulnerability from cvelistv5

Published

2023-09-11 20:20

Modified

2024-09-25 19:54

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2022:6813	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2022-1415	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2065505	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

RHPAM 7.13.1 async

cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13

Red Hat	Red Hat build of Apache Camel for Spring Boot	cpe:/a:redhat:camel_spring_boot:3
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:2
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Integration Camel K	cpe:/a:redhat:integration:1
Red Hat	Red Hat Integration Camel Quarkus	cpe:/a:redhat:camel_quarkus:2
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Data Virtualization 6	cpe:/a:redhat:jboss_data_virtualization:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat JBoss Fuse 6	cpe:/a:redhat:jboss_fuse:6
Red Hat	Red Hat JBoss Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Fuse Service Works 6	cpe:/a:redhat:jboss_fuse_service_works:6
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T00:03:05.986Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2022:6813",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2022:6813",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2022-1415",
               },
               {
                  name: "RHBZ#2065505",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2065505",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-1415",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-25T19:54:20.753486Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-25T19:54:35.795Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13",
               ],
               defaultStatus: "unaffected",
               product: "RHPAM 7.13.1 async",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_spring_boot:3",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat build of Apache Camel for Spring Boot",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:2",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "drools-core",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat Integration Camel K",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_quarkus:2",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat Integration Camel Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_virtualization:6",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat JBoss Data Virtualization 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "drools-core",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:6",
               ],
               defaultStatus: "unknown",
               packageName: "drools-core",
               product: "Red Hat JBoss Fuse 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unaffected",
               packageName: "drools-core",
               product: "Red Hat JBoss Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse_service_works:6",
               ],
               defaultStatus: "unknown",
               packageName: "drools-core",
               product: "Red Hat JBoss Fuse Service Works 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "drools-core",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Paulino Calderon (Websec) for reporting this issue.",
            },
         ],
         datePublic: "2022-10-28T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-03T15:32:23.354Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2022:6813",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2022:6813",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2022-1415",
            },
            {
               name: "RHBZ#2065505",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2065505",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2021-12-28T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2022-10-28T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Drools: unsafe data deserialization in streamutils",
         x_redhatCweChain: "CWE-502: Deserialization of Untrusted Data",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-1415",
      datePublished: "2023-09-11T20:20:23.745Z",
      dateReserved: "2022-04-20T12:43:39.822Z",
      dateUpdated: "2024-09-25T19:54:35.795Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-3628

Vulnerability from cvelistv5

Published

2023-12-18 13:43

Modified

2024-11-23 01:11

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2023:5396	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-3628	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2217924	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

Red Hat Data Grid 8.4.4

cpe:/a:redhat:jboss_data_grid:8

Red Hat

Red Hat JBoss Enterprise Application Platform 6

cpe:/a:redhat:jboss_enterprise_application_platform:6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T07:01:57.380Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2023:5396",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:5396",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-3628",
               },
               {
                  name: "RHBZ#2217924",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2217924",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240125-0004/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "infinispan",
               product: "Red Hat Data Grid 8.4.4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "infinispan",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2023-09-21T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-304",
                     description: "Missing Critical Step in Authentication",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-23T01:11:14.506Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2023:5396",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:5396",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-3628",
            },
            {
               name: "RHBZ#2217924",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2217924",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-06-22T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2023-09-21T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Infispan: rest bulk ops don't check permissions",
         x_redhatCweChain: "CWE-304: Missing Critical Step in Authentication",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-3628",
      datePublished: "2023-12-18T13:43:07.750Z",
      dateReserved: "2023-07-11T20:37:22.734Z",
      dateUpdated: "2024-11-23T01:11:14.506Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-4244

Vulnerability from cvelistv5

Published

2023-09-25 19:20

Modified

2024-08-03 01:34

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2023:2135	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:3906	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2022-4244	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2149841	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

RHINT Camel-K-1.10.1

cpe:/a:redhat:camel_k:1

Red Hat	RHPAM 7.13.1 async	cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
Red Hat	A-MQ Clients 2	cpe:/a:redhat:a_mq_clients:2
Red Hat	Red Hat A-MQ Online	cpe:/a:redhat:amq_online:1
Red Hat	Red Hat build of Apache Camel for Spring Boot	cpe:/a:redhat:camel_spring_boot:3
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:2
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Integration Camel Quarkus	cpe:/a:redhat:camel_quarkus:2
Red Hat	Red Hat Integration Change Data Capture	cpe:/a:redhat:integration:1
Red Hat	Red Hat Integration Service Registry	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat JBoss A-MQ 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat JBoss Fuse 6	cpe:/a:redhat:jboss_fuse:6
Red Hat	Red Hat JBoss Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Fuse Service Works 6	cpe:/a:redhat:jboss_fuse_service_works:6
Red Hat	Red Hat JBoss Web Server 3	cpe:/a:redhat:jboss_enterprise_web_server:3
Red Hat	Red Hat JBoss Web Server 5	cpe:/a:redhat:jboss_enterprise_web_server:5
Red Hat	Red Hat OpenShift Application Runtimes	cpe:/a:redhat:openshift_application_runtimes:1.0
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat support for Spring Boot	cpe:/a:redhat:openshift_application_runtimes:1.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-4244",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-03T18:17:37.759702Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:16:33.612Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T01:34:49.883Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2023:2135",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:2135",
               },
               {
                  name: "RHSA-2023:3906",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:3906",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2022-4244",
               },
               {
                  name: "RHBZ#2149841",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149841",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:camel_k:1",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "RHINT Camel-K-1.10.1",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13",
               ],
               defaultStatus: "unaffected",
               product: "RHPAM 7.13.1 async",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:a_mq_clients:2",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "A-MQ Clients 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_online:1",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat A-MQ Online",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_spring_boot:3",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat build of Apache Camel for Spring Boot",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:7",
               ],
               defaultStatus: "unknown",
               packageName: "plexus-utils",
               product: "Red Hat Enterprise Linux 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "maven:3.6/plexus-utils",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "maven:3.8/plexus-utils",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "unaffected",
               packageName: "maven:3.8/plexus-utils",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "unaffected",
               packageName: "plexus-utils",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_quarkus:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Integration Camel Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Integration Change Data Capture",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Integration Service Registry",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss A-MQ 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:6",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Fuse 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse_service_works:6",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Fuse Service Works 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_web_server:3",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Web Server 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_web_server:5",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Web Server 5",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_application_runtimes:1.0",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat OpenShift Application Runtimes",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "unaffected",
               packageName: "org.codehaus.plexus-plexus-utils",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-byte-buddy",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven-archiver",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-assembly-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-compiler-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven-jar-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-plugin-bundle",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven-remote-resources-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-shade-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-source-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-surefire",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-plexus-utils",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_application_runtimes:1.0",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat support for Spring Boot",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2022-12-01T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-03T15:32:27.644Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2023:2135",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
            {
               name: "RHSA-2023:3906",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:3906",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2022-4244",
            },
            {
               name: "RHBZ#2149841",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149841",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2022-12-01T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2022-12-01T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Codehaus-plexus: directory traversal",
         x_redhatCweChain: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-4244",
      datePublished: "2023-09-25T19:20:04.703Z",
      dateReserved: "2022-12-01T06:39:33.189Z",
      dateUpdated: "2024-08-03T01:34:49.883Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-1102

Vulnerability from cvelistv5

Published

2024-04-25 16:24

Modified

2025-02-27 03:21

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:3580	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3581	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3583	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-1102	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2262060	issue-tracking, x_refsource_REDHAT
	https://github.com/jberet/jsr352/issues/452

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤

Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8.0
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	Unaffected: 0:6.2.2-1.Final_redhat_00001.1.el8eap < * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	Unaffected: 0:2.1.4-1.Final_redhat_00001.1.el8eap < * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	Unaffected: 0:6.2.2-1.Final_redhat_00001.1.el9eap < * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	Unaffected: 0:2.1.4-1.Final_redhat_00001.1.el9eap < * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-1102",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-25T17:44:29.138829Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-200",
                        description: "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T18:00:15.959Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T18:26:30.505Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:3580",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3580",
               },
               {
                  name: "RHSA-2024:3581",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3581",
               },
               {
                  name: "RHSA-2024:3583",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3583",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2024-1102",
               },
               {
                  name: "RHBZ#2262060",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2262060",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/jberet/jsr352/issues/452",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/jberet/jsr352",
               defaultStatus: "unaffected",
               packageName: "jberet",
               versions: [
                  {
                     lessThan: "2.2.1",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0",
               ],
               defaultStatus: "unaffected",
               packageName: "jberet-core",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "eap8-hibernate-search",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:6.2.2-1.Final_redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "eap8-jberet",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.1.4-1.Final_redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-hibernate-search",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:6.2.2-1.Final_redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-jberet",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.1.4-1.Final_redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:",
               ],
               defaultStatus: "unaffected",
               packageName: "jberet-core",
               product: "Red Hat Build of Keycloak",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "jberet-core",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unknown",
               packageName: "jberet-core",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unknown",
               packageName: "jberet-core",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "jberet-core",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_2-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_3-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_4-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak-adapter-sso7_5-eap6",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "org.keycloak-keycloak-parent",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "jberet-core",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "jberet-core",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "unaffected",
               packageName: "jberet-core",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2024-01-29T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-523",
                     description: "Unprotected Transport of Credentials",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-27T03:21:39.444Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:3580",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3580",
            },
            {
               name: "RHSA-2024:3581",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3581",
            },
            {
               name: "RHSA-2024:3583",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3583",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-1102",
            },
            {
               name: "RHBZ#2262060",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2262060",
            },
            {
               url: "https://github.com/jberet/jsr352/issues/452",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-01-31T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-01-29T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Jberet: jberet-core logging database credentials",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-523: Unprotected Transport of Credentials",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-1102",
      datePublished: "2024-04-25T16:24:30.245Z",
      dateReserved: "2024-01-31T07:59:38.413Z",
      dateUpdated: "2025-02-27T03:21:39.444Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-1132

Vulnerability from cvelistv5

Published

2024-04-17 13:21

Modified

2025-03-03 14:54

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:1860	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1864	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1867	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1868	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2945	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3752	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3762	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3919	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3989	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-1132	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2262117	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 21.1.0 ≤
Version: 23.0.0 ≤

Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-23 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-15 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-16 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-14 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	MTA-6.2-RHEL-9	Unaffected: 6.2.3-2 < * cpe:/a:redhat:migration_toolkit_applications:6.2::el8 cpe:/a:redhat:migration_toolkit_applications:6.2::el9
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7.10
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7.11
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7.12
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22.0.10-1 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-13 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-16 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22.0.10	cpe:/a:redhat:build_keycloak:22
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	Unaffected: 0:18.0.13-1.redhat_00001.1.el7sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	Unaffected: 0:18.0.13-1.redhat_00001.1.el8sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	Unaffected: 0:18.0.13-1.redhat_00001.1.el9sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.6-46 < * cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHSSO 7.6.8	cpe:/a:redhat:red_hat_single_sign_on:7.6
Red Hat	Red Hat build of Apicurio Registry 2	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:3
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-1132",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-23T18:37:10.567431Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-22",
                        description: "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:59:39.871Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T18:26:30.564Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:1860",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1860",
               },
               {
                  name: "RHSA-2024:1861",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1861",
               },
               {
                  name: "RHSA-2024:1862",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1862",
               },
               {
                  name: "RHSA-2024:1864",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1864",
               },
               {
                  name: "RHSA-2024:1866",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1866",
               },
               {
                  name: "RHSA-2024:1867",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1867",
               },
               {
                  name: "RHSA-2024:1868",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1868",
               },
               {
                  name: "RHSA-2024:2945",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:2945",
               },
               {
                  name: "RHSA-2024:3752",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3752",
               },
               {
                  name: "RHSA-2024:3762",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3762",
               },
               {
                  name: "RHSA-2024:3919",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3919",
               },
               {
                  name: "RHSA-2024:3989",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:3989",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2024-1132",
               },
               {
                  name: "RHBZ#2262117",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2262117",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/keycloak/keycloak",
               defaultStatus: "unaffected",
               packageName: "keycloak",
               versions: [
                  {
                     lessThan: "22.0.10",
                     status: "affected",
                     version: "21.1.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "24.0.3",
                     status: "affected",
                     version: "23.0.0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-operator-bundle",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-23",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-rhel8-operator",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-15",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-web-container-rhel8",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-16",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-web-executor-container-rhel8",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-14",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:6.2::el8",
                  "cpe:/a:redhat:migration_toolkit_applications:6.2::el9",
               ],
               defaultStatus: "affected",
               packageName: "mta/mta-windup-addon-rhel9",
               product: "MTA-6.2-RHEL-9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "6.2.3-2",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7.10",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat AMQ Broker 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7.11",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat AMQ Broker 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7.12",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat AMQ Broker 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-operator-bundle",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22.0.10-1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9-operator",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-16",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat build of Keycloak 22.0.10",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.13-1.redhat_00001.1.el7sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.13-1.redhat_00001.1.el8sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.13-1.redhat_00001.1.el9sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhosemc:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso-7/sso76-openshift-rhel8",
               product: "RHEL-8 based Middleware Containers",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "7.6-46",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "RHSSO 7.6.8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat build of Apicurio Registry 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:3",
               ],
               defaultStatus: "affected",
               packageName: "org.keycloak/keycloak-core",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "org.wildfly.security-wildfly-elytron-parent",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Axel Flamcourt for reporting this issue.",
            },
         ],
         datePublic: "2024-04-16T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-03T14:54:33.245Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:1860",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1860",
            },
            {
               name: "RHSA-2024:1861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1861",
            },
            {
               name: "RHSA-2024:1862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1862",
            },
            {
               name: "RHSA-2024:1864",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1864",
            },
            {
               name: "RHSA-2024:1866",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1866",
            },
            {
               name: "RHSA-2024:1867",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1867",
            },
            {
               name: "RHSA-2024:1868",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1868",
            },
            {
               name: "RHSA-2024:2945",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2945",
            },
            {
               name: "RHSA-2024:3752",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3752",
            },
            {
               name: "RHSA-2024:3762",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3762",
            },
            {
               name: "RHSA-2024:3919",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3919",
            },
            {
               name: "RHSA-2024:3989",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3989",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-1132",
            },
            {
               name: "RHBZ#2262117",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2262117",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-01-31T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-04-16T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Keycloak: path transversal in redirection validation",
         workarounds: [
            {
               lang: "en",
               value: "No current mitigation is available for this vulnerability.",
            },
         ],
         x_redhatCweChain: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-1132",
      datePublished: "2024-04-17T13:21:19.130Z",
      dateReserved: "2024-01-31T17:07:33.455Z",
      dateUpdated: "2025-03-03T14:54:33.245Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-6717

Vulnerability from cvelistv5

Published

2024-04-25 16:02

Modified

2025-03-15 03:35

Severity ?

6.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Summary

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:1353	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1867	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1868	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2945	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:4057	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6717	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2253952	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0
Version: 24.0.0

Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7.12
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22.0.10-1 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-13 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-16 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22.0.10	cpe:/a:redhat:build_keycloak:22
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-3 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHOSS-1.33-RHEL-8	Unaffected: 1.33.0-5 < * cpe:/a:redhat:openshift_serverless:1.33::el8
Red Hat	RHPAM 7.13.5 async	cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
Red Hat	Migration Toolkit for Applications 6	cpe:/a:redhat:migration_toolkit_applications:6
Red Hat	Migration Toolkit for Applications 7	cpe:/a:redhat:migration_toolkit_applications:7
Red Hat	Red Hat build of Apicurio Registry 2	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:2
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Developer Hub	cpe:/a:redhat:rhdh:1
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-6717",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-25T19:15:14.697195Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:16:59.611Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T08:35:14.887Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2024:1867",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1867",
               },
               {
                  name: "RHSA-2024:1868",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:1868",
               },
               {
                  name: "RHSA-2024:2945",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:2945",
               },
               {
                  name: "RHSA-2024:4057",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:4057",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-6717",
               },
               {
                  name: "RHBZ#2253952",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2253952",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/keycloak/keycloak",
               defaulStatus: "unaffected",
               packageName: "keycloak",
               versions: [
                  {
                     lessThan: "22.0.10",
                     status: "affected",
                     version: "0",
                     versionType: "maven",
                  },
                  {
                     lessThan: "24.0.3",
                     status: "affected",
                     version: "24.0.0",
                     versionType: "maven",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7.12",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat AMQ Broker 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-operator-bundle",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22.0.10-1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-13",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9-operator",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-16",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat build of Keycloak 22.0.10",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-data-index-ephemeral-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-data-index-postgresql-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-jobs-service-postgresql-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-operator-bundle",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-rhel8-operator",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-3",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-swf-builder-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:openshift_serverless:1.33::el8",
               ],
               defaultStatus: "affected",
               packageName: "openshift-serverless-1/logic-swf-devmode-rhel8",
               product: "RHOSS-1.33-RHEL-8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.33.0-5",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13",
               ],
               defaultStatus: "unaffected",
               product: "RHPAM 7.13.5 async",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:6",
               ],
               defaultStatus: "affected",
               packageName: "mta/mta-ui-rhel9",
               product: "Migration Toolkit for Applications 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:7",
               ],
               defaultStatus: "unaffected",
               packageName: "mta/mta-ui-rhel9",
               product: "Migration Toolkit for Applications 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat build of Apicurio Registry 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:2",
               ],
               defaultStatus: "unaffected",
               packageName: "org.keycloak/keycloak-core",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhdh:1",
               ],
               defaultStatus: "affected",
               packageName: "rhdh-hub-container",
               product: "Red Hat Developer Hub",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "org.keycloak-keycloak-parent",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_gitops:1",
               ],
               defaultStatus: "affected",
               packageName: "openshift-gitops-1/gitops-rhel8-operator",
               product: "Red Hat OpenShift GitOps",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2024-04-16T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-15T03:35:00.190Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:1353",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1353",
            },
            {
               name: "RHSA-2024:1867",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1867",
            },
            {
               name: "RHSA-2024:1868",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1868",
            },
            {
               name: "RHSA-2024:2945",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2945",
            },
            {
               name: "RHSA-2024:4057",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:4057",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-6717",
            },
            {
               name: "RHBZ#2253952",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2253952",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-12-11T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-04-16T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Keycloak: xss via assertion consumer service url in saml post-binding flow",
         x_redhatCweChain: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-6717",
      datePublished: "2024-04-25T16:02:03.267Z",
      dateReserved: "2023-12-12T07:30:43.924Z",
      dateUpdated: "2025-03-15T03:35:00.190Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-4639

Vulnerability from cvelistv5

Published

2024-11-17 10:21

Modified

2025-02-07 17:02

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:1674	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1675	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1676	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1677	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2763	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2764	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3919	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-4639	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2166022	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

Migration Toolkit for Runtimes 1 on RHEL 8

Unaffected: 1.2-23 < *
cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8

Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-15 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-16 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	Migration Toolkit for Runtimes 1 on RHEL 8	Unaffected: 1.2-14 < * cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7.4
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	Unaffected: 0:2.2.30-1.SP1_redhat_00001.1.el8eap < * cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	Unaffected: 0:2.2.30-1.SP1_redhat_00001.1.el9eap < * cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	Unaffected: 0:2.2.30-1.SP1_redhat_00001.1.el7eap < * cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8.0
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	Unaffected: 0:2.3.11-1.SP1_redhat_00001.1.el8eap < * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	Unaffected: 0:2.3.11-1.SP1_redhat_00001.1.el9eap < * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red Hat	Migration Toolkit for Applications 6	cpe:/a:redhat:migration_toolkit_applications:6
Red Hat	Red Hat build of Apache Camel for Spring Boot 3	cpe:/a:redhat:camel_spring_boot:3
Red Hat	Red Hat build of Apicurio Registry	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:2
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat Integration Camel K	cpe:/a:redhat:integration:1
Red Hat	Red Hat Integration Camel Quarkus	cpe:/a:redhat:camel_quarkus:2
Red Hat	Red Hat Integration Change Data Capture	cpe:/a:redhat:integration:1
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Fuse 6	cpe:/a:redhat:jboss_fuse:6
Red Hat	Red Hat JBoss Fuse Service Works 6	cpe:/a:redhat:jboss_fuse_service_works:6
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-4639",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-17T16:17:32.886591Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-17T16:17:46.027Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-02-07T17:02:40.205Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250207-0001/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-operator-bundle",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-23",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-rhel8-operator",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-15",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-web-container-rhel8",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-16",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "mtr/mtr-web-executor-container-rhel8",
               product: "Migration Toolkit for Runtimes 1 on RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "1.2-14",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
               ],
               defaultStatus: "affected",
               packageName: "eap7-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.2.30-1.SP1_redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap7-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.2.30-1.SP1_redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.2.30-1.SP1_redhat_00001.1.el7eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.3.11-1.SP1_redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.3.11-1.SP1_redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:6",
               ],
               defaultStatus: "affected",
               packageName: "org.keycloak-keycloak-parent",
               product: "Migration Toolkit for Applications 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_spring_boot:3",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat build of Apache Camel for Spring Boot 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat build of Apicurio Registry",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:2",
               ],
               defaultStatus: "unknown",
               packageName: "io.quarkus/quarkus-undertow",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat Integration Camel K",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_quarkus:2",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat Integration Camel Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat Integration Change Data Capture",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:6",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat JBoss Fuse 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse_service_works:6",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat JBoss Fuse Service Works 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank Ankur Sundara for reporting this issue.",
            },
         ],
         datePublic: "2024-02-08T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-444",
                     description: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-17T10:21:44.539Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:1674",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1674",
            },
            {
               name: "RHSA-2024:1675",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1675",
            },
            {
               name: "RHSA-2024:1676",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1676",
            },
            {
               name: "RHSA-2024:1677",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:1677",
            },
            {
               name: "RHSA-2024:2763",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2763",
            },
            {
               name: "RHSA-2024:2764",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:2764",
            },
            {
               name: "RHSA-2024:3919",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:3919",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-4639",
            },
            {
               name: "RHBZ#2166022",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2166022",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-01-28T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-02-08T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Undertow: cookie smuggling/spoofing",
         x_redhatCweChain: "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-4639",
      datePublished: "2024-11-17T10:21:44.539Z",
      dateReserved: "2023-08-30T14:52:04.007Z",
      dateUpdated: "2025-02-07T17:02:40.205Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-4245

Vulnerability from cvelistv5

Published

2023-09-25 19:20

Modified

2024-08-03 01:34

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2023:2135	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:3906	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2022-4245	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2149843	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

RHINT Camel-K-1.10.1

cpe:/a:redhat:camel_k:1

Red Hat	RHPAM 7.13.1 async	cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
Red Hat	A-MQ Clients 2	cpe:/a:redhat:a_mq_clients:2
Red Hat	Red Hat A-MQ Online	cpe:/a:redhat:amq_online:1
Red Hat	Red Hat build of Apache Camel for Spring Boot	cpe:/a:redhat:camel_spring_boot:3
Red Hat	Red Hat build of Quarkus	cpe:/a:redhat:quarkus:2
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Integration Camel Quarkus	cpe:/a:redhat:camel_quarkus:2
Red Hat	Red Hat Integration Change Data Capture	cpe:/a:redhat:integration:1
Red Hat	Red Hat Integration Service Registry	cpe:/a:redhat:service_registry:2
Red Hat	Red Hat JBoss A-MQ 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat JBoss Fuse 6	cpe:/a:redhat:jboss_fuse:6
Red Hat	Red Hat JBoss Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Fuse Service Works 6	cpe:/a:redhat:jboss_fuse_service_works:6
Red Hat	Red Hat JBoss Web Server 3	cpe:/a:redhat:jboss_enterprise_web_server:3
Red Hat	Red Hat JBoss Web Server 5	cpe:/a:redhat:jboss_enterprise_web_server:5
Red Hat	Red Hat OpenShift Application Runtimes	cpe:/a:redhat:openshift_application_runtimes:1.0
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Red Hat	Red Hat support for Spring Boot	cpe:/a:redhat:openshift_application_runtimes:1.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-4245",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-07T17:32:13.401725Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:16:32.674Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T01:34:49.896Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2023:2135",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:2135",
               },
               {
                  name: "RHSA-2023:3906",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:3906",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2022-4245",
               },
               {
                  name: "RHBZ#2149843",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149843",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:camel_k:1",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "RHINT Camel-K-1.10.1",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13",
               ],
               defaultStatus: "unaffected",
               product: "RHPAM 7.13.1 async",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:a_mq_clients:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "A-MQ Clients 2",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:amq_online:1",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat A-MQ Online",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_spring_boot:3",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat build of Apache Camel for Spring Boot",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:7",
               ],
               defaultStatus: "unknown",
               packageName: "plexus-utils",
               product: "Red Hat Enterprise Linux 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "maven:3.6/plexus-utils",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:8",
               ],
               defaultStatus: "unaffected",
               packageName: "maven:3.8/plexus-utils",
               product: "Red Hat Enterprise Linux 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "unaffected",
               packageName: "maven:3.8/plexus-utils",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/o:redhat:enterprise_linux:9",
               ],
               defaultStatus: "unaffected",
               packageName: "plexus-utils",
               product: "Red Hat Enterprise Linux 9",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_quarkus:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Integration Camel Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Integration Change Data Capture",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:service_registry:2",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Integration Service Registry",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:amq_broker:7",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss A-MQ 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:6",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Fuse 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse_service_works:6",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Fuse Service Works 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_web_server:3",
               ],
               defaultStatus: "unknown",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Web Server 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_web_server:5",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat JBoss Web Server 5",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_application_runtimes:1.0",
               ],
               defaultStatus: "unaffected",
               packageName: "codehaus-plexus",
               product: "Red Hat OpenShift Application Runtimes",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "affected",
               packageName: "org.codehaus.plexus-plexus-utils",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-byte-buddy",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven-archiver",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-assembly-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-compiler-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven-jar-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-plugin-bundle",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-maven-remote-resources-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-shade-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-source-plugin",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "affected",
               packageName: "rh-maven36-maven-surefire",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhel_software_collections:3",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-maven36-plexus-utils",
               product: "Red Hat Software Collections",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:openshift_application_runtimes:1.0",
               ],
               defaultStatus: "affected",
               packageName: "codehaus-plexus",
               product: "Red Hat support for Spring Boot",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2022-12-01T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-91",
                     description: "XML Injection (aka Blind XPath Injection)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-03T15:32:28.238Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2023:2135",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:2135",
            },
            {
               name: "RHSA-2023:3906",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:3906",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2022-4245",
            },
            {
               name: "RHBZ#2149843",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2149843",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2022-12-01T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2022-12-01T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Codehaus-plexus: xml external entity (xxe) injection",
         x_redhatCweChain: "CWE-91: XML Injection (aka Blind XPath Injection)",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-4245",
      datePublished: "2023-09-25T19:20:57.329Z",
      dateReserved: "2022-12-01T06:39:39.475Z",
      dateUpdated: "2024-08-03T01:34:49.896Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-6291

Vulnerability from cvelistv5

Published

2024-01-26 14:23

Modified

2025-04-03 02:35

Severity ?

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Summary

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2023:7854	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7855	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7856	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7857	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7858	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7860	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2023:7861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0798	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0799	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0800	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0801	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0804	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6291	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2251407	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

Red Hat build of Keycloak 22

Unaffected: 22.0.7-1 < *
cpe:/a:redhat:build_keycloak:22::el9

Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-6 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22	Unaffected: 22-9 < * cpe:/a:redhat:build_keycloak:22::el9
Red Hat	Red Hat build of Keycloak 22.0.7	cpe:/a:redhat:build_keycloak:22
Red Hat	Red Hat Single Sign-On 7.0	cpe:/a:redhat:red_hat_single_sign_on:7.6
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	Unaffected: 0:18.0.11-2.redhat_00003.1.el7sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	Unaffected: 0:18.0.12-1.redhat_00001.1.el7sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	Unaffected: 0:18.0.11-2.redhat_00003.1.el8sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	Unaffected: 0:18.0.12-1.redhat_00001.1.el8sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	Unaffected: 0:18.0.11-2.redhat_00003.1.el9sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	Unaffected: 0:18.0.12-1.redhat_00001.1.el9sso < * cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.6-38 < * cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.6.6-2 < * cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	RHEL-8 based Middleware Containers	Unaffected: 7.6-41 < * cpe:/a:redhat:rhosemc:1.0::el8
Red Hat	Single Sign-On 7.6.6	cpe:/a:redhat:red_hat_single_sign_on:7.6.6
Red Hat	Migration Toolkit for Applications 6	cpe:/a:redhat:migration_toolkit_applications:6
Red Hat	Migration Toolkit for Applications 7	cpe:/a:redhat:migration_toolkit_applications:7
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Decision Manager 7	cpe:/a:redhat:jboss_enterprise_brms_platform:7
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Data Grid 7	cpe:/a:redhat:jboss_data_grid:7
Red Hat	Red Hat JBoss Enterprise Application Platform 6	cpe:/a:redhat:jboss_enterprise_application_platform:6
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T08:28:21.867Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2023:7854",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7854",
               },
               {
                  name: "RHSA-2023:7855",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7855",
               },
               {
                  name: "RHSA-2023:7856",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7856",
               },
               {
                  name: "RHSA-2023:7857",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7857",
               },
               {
                  name: "RHSA-2023:7858",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7858",
               },
               {
                  name: "RHSA-2023:7860",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7860",
               },
               {
                  name: "RHSA-2023:7861",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:7861",
               },
               {
                  name: "RHSA-2024:0798",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:0798",
               },
               {
                  name: "RHSA-2024:0799",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:0799",
               },
               {
                  name: "RHSA-2024:0800",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:0800",
               },
               {
                  name: "RHSA-2024:0801",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:0801",
               },
               {
                  name: "RHSA-2024:0804",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2024:0804",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-6291",
               },
               {
                  name: "RHBZ#2251407",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2251407",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-6291",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-13T14:56:46.143772Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-13T14:56:59.598Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-operator-bundle",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22.0.7-1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-6",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9-operator",
               product: "Red Hat build of Keycloak 22",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "22-9",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:22",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat build of Keycloak 22.0.7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Single Sign-On 7.0",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.11-2.redhat_00003.1.el7sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.12-1.redhat_00001.1.el7sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.11-2.redhat_00003.1.el8sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.12-1.redhat_00001.1.el8sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.11-2.redhat_00003.1.el9sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat Single Sign-On 7.6 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:18.0.12-1.redhat_00001.1.el9sso",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhosemc:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso-7/sso76-openshift-rhel8",
               product: "RHEL-8 based Middleware Containers",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "7.6-38",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhosemc:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso-7/sso7-rhel8-operator-bundle",
               product: "RHEL-8 based Middleware Containers",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "7.6.6-2",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:rhosemc:1.0::el8",
               ],
               defaultStatus: "affected",
               packageName: "rh-sso-7/sso76-openshift-rhel8",
               product: "RHEL-8 based Middleware Containers",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "7.6-41",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7.6.6",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Single Sign-On 7.6.6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:6",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Migration Toolkit for Applications 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:migration_toolkit_applications:7",
               ],
               defaultStatus: "affected",
               packageName: "keycloak",
               product: "Migration Toolkit for Applications 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:serverless:1",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "OpenShift Serverless",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Decision Manager 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unaffected",
               packageName: "rh-sso7-keycloak",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "unaffected",
               packageName: "keycloak",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2023-12-14T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-601",
                     description: "URL Redirection to Untrusted Site ('Open Redirect')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-04-03T02:35:28.214Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2023:7854",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7854",
            },
            {
               name: "RHSA-2023:7855",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7855",
            },
            {
               name: "RHSA-2023:7856",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7856",
            },
            {
               name: "RHSA-2023:7857",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7857",
            },
            {
               name: "RHSA-2023:7858",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7858",
            },
            {
               name: "RHSA-2023:7860",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7860",
            },
            {
               name: "RHSA-2023:7861",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:7861",
            },
            {
               name: "RHSA-2024:0798",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:0798",
            },
            {
               name: "RHSA-2024:0799",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:0799",
            },
            {
               name: "RHSA-2024:0800",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:0800",
            },
            {
               name: "RHSA-2024:0801",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:0801",
            },
            {
               name: "RHSA-2024:0804",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:0804",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-6291",
            },
            {
               name: "RHBZ#2251407",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2251407",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-11-24T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2023-12-14T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Keycloak: redirect_uri validation bypass",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-6291",
      datePublished: "2024-01-26T14:23:43.185Z",
      dateReserved: "2023-11-24T18:16:45.923Z",
      dateUpdated: "2025-04-03T02:35:28.214Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-3629

Vulnerability from cvelistv5

Published

2023-12-18 13:43

Modified

2024-11-23 01:11

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2023:5396	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-3629	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2217926	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Red Hat

Red Hat Data Grid 8.4.4

cpe:/a:redhat:jboss_data_grid:8

Red Hat

Red Hat JBoss Enterprise Application Platform 6

cpe:/a:redhat:jboss_enterprise_application_platform:6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T07:01:57.037Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2023:5396",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2023:5396",
               },
               {
                  tags: [
                     "vdb-entry",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2023-3629",
               },
               {
                  name: "RHBZ#2217926",
                  tags: [
                     "issue-tracking",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2217926",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240125-0004/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "unaffected",
               packageName: "infinispan",
               product: "Red Hat Data Grid 8.4.4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:6",
               ],
               defaultStatus: "unknown",
               packageName: "infinispan",
               product: "Red Hat JBoss Enterprise Application Platform 6",
               vendor: "Red Hat",
            },
         ],
         datePublic: "2023-09-21T00:00:00+00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-304",
                     description: "Missing Critical Step in Authentication",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-23T01:11:20.456Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2023:5396",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2023:5396",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2023-3629",
            },
            {
               name: "RHBZ#2217926",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2217926",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-06-27T00:00:00+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2023-09-21T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Infinispan: non-admins should not be able to get cache config via rest api",
         x_redhatCweChain: "CWE-304: Missing Critical Step in Authentication",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2023-3629",
      datePublished: "2023-12-18T13:43:07.770Z",
      dateReserved: "2023-07-11T20:51:42.907Z",
      dateUpdated: "2024-11-23T01:11:20.456Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerabilites related to Red Hat - Red Hat JBoss Enterprise Application Platform 6

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5