CVE-2024-10039

keycloak-core: mTLS passthrough

View on CVE.org
Published n/a CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Description
A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-93ww-43rr-79v3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
History
Type Values Removed Values Added
Description A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.
Title keycloak-core: mTLS passthrough
First Time appeared Redhat
Redhat build Keycloak
Weaknesses CWE-295
CPEs cpe:/a:redhat:build_keycloak:24
cpe:/a:redhat:build_keycloak:24::el9
cpe:/a:redhat:build_keycloak:26
cpe:/a:redhat:build_keycloak:26.0::el9
Vendors & Products Redhat
Redhat build Keycloak
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important
Weaknesses

Sources

No data.

No data.

No data.

Severity
Important
Public date
Nov 21, 2024, 4:45 PM

View source Bugzilla JSON

No data.