Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-0264

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Published

2023-08-04T18:15:11.090

Last Modified

2024-11-21T07:36:51.503

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.0 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat keycloak < 18.0.6 Yes
Application redhat single_sign-on < 7.6.2 Yes
Operating System redhat enterprise_linux 7.0 No
Operating System redhat enterprise_linux 8.0 No
Operating System redhat enterprise_linux 9.0 No
Application redhat openshift_container_platform 4.9 Yes
Application redhat openshift_container_platform 4.10 Yes
Application redhat openshift_container_platform_for_ibm_linuxone 4.9 Yes
Application redhat openshift_container_platform_for_ibm_linuxone 4.10 Yes
Application redhat openshift_container_platform_ibm_z_systems 4.9 Yes
Application redhat openshift_container_platform_ibm_z_systems 4.10 Yes
Application redhat single_sign-on < 7.6.2 Yes
Operating System redhat enterprise_linux 8.0 No
Application redhat single_sign-on - Yes
References