Red Hat Build Of Keycloak 24.0.9 vulnerabilities

4 CVEs affecting Red Hat Build Of Keycloak 24.0.9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-9666, published 2024-11-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-10270, published 2024-11-25. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system…
CVE-2024-10451, published 2024-11-25. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode,…
CVE-2024-10492, published 2024-11-25. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high…
CVE-2024-9666, published 2024-11-25. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to…