Vulnerability-Lookup

BDU:2024-01582

Vulnerability from fstec - Published: 21.02.2024

Title

Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с чрезмерно ограничительным механизмом блокировки учётных данных пользователя, позволяющая нарушителю заблокировать доступ пользователя к его учетной записи

Description

Уязвимость программного средства для управления идентификацией и доступом Keycloak связана с чрезмерно ограничительным механизмом блокировки учётных данных пользователя. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, заблокировать доступ пользователя к его учетной записи

Severity ?


                    
                      AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Vendor

Red Hat Inc., The CentOS Project

Software Name

Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, CentOS, Keycloak

Software Version

7 (Red Hat Enterprise Linux), 8 (Red Hat Enterprise Linux), 3.11 (Red Hat OpenShift Container Platform), 4 (Red Hat OpenShift Container Platform), 9 (Red Hat Enterprise Linux), 8 (CentOS), до 23.0.5 включительно (Keycloak)

Possible Mitigations

Компенсирующие меры: - ограничить частоту регистрации учетной записи; - ограничить регистрацию новой учетной записи, не разрешая указывать адреса электронной почты в поле имени пользователя.

Reference

https://access.redhat.com/security/cve/cve-2024-1722 https://bugzilla.redhat.com/show_bug.cgi?id=2265389 https://yanac.hu/2024/02/21/cve-2024-1722-keycloak-account-lockout-denial-of-service/ https://vuldb.com/ru/?id.254464 https://security.snyk.io/vuln/SNYK-RHEL8-PODMAN-6262276 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262233 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262232 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262231 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262230 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANGVPROXY-6262229 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262228 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262227 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262226 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANCATATONIT-6262225 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262224 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANDOCKER-6262223 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262222 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262221 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANPLUGINS-6262220 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262219 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANTESTS-6262218 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262217 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANMANPAGES-6262216 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262215 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262214 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMAN-6262213 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262212 https://security.snyk.io/vuln/SNYK-CENTOS8-PODMANREMOTE-6262211 https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262210 https://security.snyk.io/vuln/SNYK-CENTOS9-PODMANREMOTE-6261896 https://security.snyk.io/vuln/SNYK-RHEL9-PODMANREMOTE-6261895 https://security.snyk.io/vuln/SNYK-CENTOS9-PODMANCATATONIT-6261894 https://security.snyk.io/vuln/SNYK-RHEL9-PODMANCATATONIT-6261893 https://security.snyk.io/vuln/SNYK-CENTOS9-PODMANTESTS-6261892

CWE

CWE-404, CWE-645

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat Inc., The CentOS Project",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7 (Red Hat Enterprise Linux), 8 (Red Hat Enterprise Linux), 3.11 (Red Hat OpenShift Container Platform), 4 (Red Hat OpenShift Container Platform), 9 (Red Hat Enterprise Linux), 8 (CentOS), \u0434\u043e 23.0.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Keycloak)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0447\u0430\u0441\u0442\u043e\u0442\u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043d\u043e\u0432\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438, \u043d\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044f \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u0430\u0434\u0440\u0435\u0441\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b \u0432 \u043f\u043e\u043b\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "21.02.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "27.02.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "27.02.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-01582",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-1722",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, CentOS, Keycloak",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat Inc. Red Hat Enterprise Linux 7 , Red Hat Inc. Red Hat Enterprise Linux 8 , Red Hat Inc. Red Hat Enterprise Linux 9 , The CentOS Project CentOS 8 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c Keycloak, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u0435\u0433\u043e \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0437\u0430\u0447\u0438\u0441\u0442\u043a\u0430 \u0438\u043b\u0438 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 (CWE-404), \u0427\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f (CWE-645)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c Keycloak \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0447\u0440\u0435\u0437\u043c\u0435\u0440\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u0435\u0433\u043e \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438, \u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://access.redhat.com/security/cve/cve-2024-1722\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2265389\nhttps://yanac.hu/2024/02/21/cve-2024-1722-keycloak-account-lockout-denial-of-service/\nhttps://vuldb.com/ru/?id.254464\nhttps://security.snyk.io/vuln/SNYK-RHEL8-PODMAN-6262276\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262233\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262232\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262231\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262230\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANGVPROXY-6262229\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262228\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262227\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262226\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANCATATONIT-6262225\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262224\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANDOCKER-6262223\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262222\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262221\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANPLUGINS-6262220\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262219\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANTESTS-6262218\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262217\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANMANPAGES-6262216\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262215\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262214\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMAN-6262213\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262212\nhttps://security.snyk.io/vuln/SNYK-CENTOS8-PODMANREMOTE-6262211\nhttps://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262210\nhttps://security.snyk.io/vuln/SNYK-CENTOS9-PODMANREMOTE-6261896\nhttps://security.snyk.io/vuln/SNYK-RHEL9-PODMANREMOTE-6261895\nhttps://security.snyk.io/vuln/SNYK-CENTOS9-PODMANCATATONIT-6261894\nhttps://security.snyk.io/vuln/SNYK-RHEL9-PODMANCATATONIT-6261893\nhttps://security.snyk.io/vuln/SNYK-CENTOS9-PODMANTESTS-6261892",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-404, CWE-645",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 2,6)\n\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,7)"
}

CVE-2024-1722 (GCVE-0-2024-1722)

Vulnerability from cvelistv5 – Published: 2024-02-27 17:39 – Updated: 2025-11-21 06:27

Title

Keycloak-core: dos via account lockout

Summary

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-645 - Overly Restrictive Account Lockout Mechanism

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2024-1722	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2265389	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Affected: 4.15.0

	Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
	Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Date Public ?

2024-02-21 00:00

Credits

Red Hat would like to thank Maor Abutbul (CyberArk) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1722",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-29T20:52:47.119910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:05.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:21.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-1722"
          },
          {
            "name": "RHBZ#2265389",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265389"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://bitbucket.org/b_c/jose4j/src/master/",
          "defaultStatus": "unaffected",
          "packageName": "keycloak-core",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "keycloak-core",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Maor Abutbul (CyberArk) for reporting this issue."
        }
      ],
      "datePublic": "2024-02-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-645",
              "description": "Overly Restrictive Account Lockout Mechanism",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-21T06:27:40.399Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-1722"
        },
        {
          "name": "RHBZ#2265389",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265389"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-12T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-02-21T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-core: dos via account lockout",
      "workarounds": [
        {
          "lang": "en",
          "value": "Red Hat Product Security is not aware of a way to completely mitigate this issue. However, the following techniques can be used to help prevent exploitation:\n- Put limits on frequency of account registration, restricting how often an attacker could utilize this attack \n- Restrict new account registration to not allow email addresses in the username field, for example, by not allowing the \"@\" symbol. Note: this cannot prevent attacks against existing users who have registered with an email address.\n\nIf this vulnerability has been triggered, an administrator has two options to remedy it manually by modifying the second account (of the attacker):\n- Delete the account\n- Change the username"
        }
      ],
      "x_redhatCweChain": "CWE-645: Overly Restrictive Account Lockout Mechanism"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-1722",
    "datePublished": "2024-02-27T17:39:13.261Z",
    "dateReserved": "2024-02-21T19:39:16.206Z",
    "dateUpdated": "2025-11-21T06:27:40.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2024-01582

CVE-2024-1722 (GCVE-0-2024-1722)

Tags

Sightings

Nomenclature