Red Hat Build Of Keycloak 24 vulnerabilities

6 CVEs affecting Red Hat Build Of Keycloak 24, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-9666, published 2024-11-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-8698, published 2024-09-19. High severity, CVSS 7.7. EPSS: 2% chance of exploitation in the next 30 days. A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for…
CVE-2024-10270, published 2024-11-25. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system…
CVE-2024-10451, published 2024-11-25. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode,…
CVE-2024-10492, published 2024-11-25. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high…
CVE-2024-4540, published 2024-06-03. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the…
CVE-2024-9666, published 2024-11-25. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to…