Aller au contenu
en Se connecter
2.7 Faible

CVE-2024-5967 A vulnerability was found in Keycloak

Description

A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL  independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Build of Keycloak Versions non publiées
Red Hat build of Keycloak 22 22 premières → < 22-20 22-20
Red Hat Single Sign-On 7 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 7 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 8 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 9 Versions non publiées
RHEL-8 based Middleware Containers 7.6 premières → < 7.6-52 7.6-52
Red Hat Single Sign-On 7.0 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Build of Keycloak

Les 266 CVE de Red Hat Build of Keycloak →
CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 Élevée CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 Élevée CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Moyenne CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 Élevée
Suivre cette CVE