CVE-2024-2419

{"id": "CVE-2024-2419", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.8}]}, "published": "2024-04-17T14:15:08.367", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1867", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2419", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269371", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1867", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2419", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269371", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en la l\u00f3gica de validaci\u00f3n de redirecci\u00f3n_uri de Keycloak. Este problema puede permitir la omisi\u00f3n de hosts permitidos expl\u00edcitamente. Un ataque exitoso puede conducir al robo de un token de acceso, lo que hace posible que el atacante se haga pasar por otros usuarios. Es muy similar a CVE-2023-6291."}], "lastModified": "2024-11-21T09:09:42.800", "sourceIdentifier": "secalert@redhat.com"}