4.2
Moyenne
CVE-2024-12369 A vulnerability was found in OIDC-Client
Description
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | Versions non publiées | |
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | Versions non publiées |
Références
- RHSA-2025:3989 access.redhat.com
- RHSA-2025:3990 access.redhat.com
- RHSA-2025:3992 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2331178 bugzilla.redhat.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Les 18 CVE de Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 →
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.6
Critique
CVE-2024-3884
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
Élevée
CVE-2025-9784
Undertow: undertow madeyoureset http/2 ddos vulnerability
7.5
Élevée
CVE-2025-2251
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans…
6.2
Moyenne