Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos (keycloak)

CVE-2024-1249
HIGH 7.4

At a glance

Source
NVD
EPSS
EPSS 0.45 % · percentile 39 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Search on…

Description

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Weaknesses (CWE)

  • CWE-346 — Origin Validation Error

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:Hredhat
CVSS 3.1HIGH 7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:HNVD · secalert@redhat.com (Secondary)

Advisories

European references

Affected products

ProductVersions
keycloakaffected 21.1.0 < 22.0.10 ; affected 23.0.0 < 24.0.3
Red Hat · Red Hat AMQ Broker 7
Red Hat · Red Hat build of Keycloak 22unaffected 22.0.10-1 < *
Red Hat · Red Hat build of Keycloak 22unaffected 22-13 < *
Red Hat · Red Hat build of Keycloak 22unaffected 22-16 < *
Red Hat · Red Hat build of Keycloak 22.0.10
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.13-1.redhat_00001.1.el7sso < *
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.13-1.redhat_00001.1.el8sso < *
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.13-1.redhat_00001.1.el9sso < *
Red Hat · RHEL-8 based Middleware Containersunaffected 7.6-46 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-3 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHOSS-1.33-RHEL-8unaffected 1.33.0-5 < *
Red Hat · RHSSO 7.6.8

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD