CVE-2024-5203

Keycloak: Login CSRF

View on CVE.org
Published Jun 12, 2024 CVSS 3.1 · 3.7 Low EPSS n/a KEV · Not listed
Description
After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Keycloak: login csrf Keycloak: Login CSRF
Type Values Removed Values Added
Description A Cross-site request forgery (CSRF) flaw was found in Keycloak and occurs due to the lack of a unique token sent during the authentication POST request, /login-actions/authenticate. This flaw allows an attacker to craft a malicious login page and trick a legitimate user of an application into authenticating with an attacker-controlled account instead of their own. After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.
CPEs cpe:/a:redhat:build_keycloak:22
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On

Subscriptions

No data.

Weaknesses

Sources

Status
REJECTED
Assigner
redhat
Published
Updated
Sep 13, 2024, 10:15 AM
Reserved
May 22, 2024, 3:10 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Jun 12, 2024, 9:15 AM
Modified
Sep 13, 2024, 11:15 AM

View source JSON

Severity
Low
Public date
May 22, 2024, 12:00 AM

View source Bugzilla JSON

No data.