CVE-2023-0264

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

A

flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2023-0264	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0264	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:a:redhat:openshift_container_platform:4.9:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.10:::::::*
	cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:::::::*
	cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:::::::*
	cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:::::::*
	cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:::::::*
	cpe:2.3:a:redhat:single_sign-on::::::::

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

History

21 Nov 2024, 07:36

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/security/cve/CVE-2023-0264 - Vendor Advisory~~	() https://access.redhat.com/security/cve/CVE-2023-0264 - Vendor Advisory

Information

Published : 2023-08-04 18:15

Updated : 2024-11-21 07:36

NVD link : CVE-2023-0264

Mitre link : CVE-2023-0264

CVE.ORG link : CVE-2023-0264

JSON object : View

Products Affected

CWE

CWE-287

Improper Authentication

{"id": "CVE-2023-0264", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}]}, "published": "2023-08-04T18:15:11.090", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-0264", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-0264", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability."}, {"lang": "es", "value": "Se ha encontrado un fallo en la autenticaci\u00f3n de usuarios en OpenID Connect de Keycloak, que podr\u00eda autenticar incorrectamente las solicitudes. Un atacante autenticado que pudiera obtener informaci\u00f3n de una solicitud de usuario dentro del mismo entorno, podr\u00eda utilizar esos datos para hacerse pasar por la v\u00edctima y generar nuevos tokens de sesi\u00f3n. Este problema podr\u00eda afectar a la confidencialidad, integridad y disponibilidad.\n"}], "lastModified": "2024-11-21T07:36:51.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "738E7B84-4EE9-40BF-BA2B-792E5620C117", "versionEndExcluding": "18.0.6"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCDDF884-6BF1-4EE8-990E-4DAB22BC5EEB", "versionEndExcluding": "7.6.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81609549-25CE-4C8A-9DE3-170D23704208"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0595C9F8-9C7A-4FC1-B7EE-52978A1B1E93"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C519B1A-1CD6-426C-9339-F28E4FEF581B"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91EE3858-A648-44B4-B282-8F808D88D3B9"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC262C4C-7B6A-4117-A50F-1FF69296DDD8"}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E58526FB-522F-4AAC-B03C-9CAB443D0CFF"}, {"criteria": "cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCDDF884-6BF1-4EE8-990E-4DAB22BC5EEB", "versionEndExcluding": "7.6.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*", "vulnerable": true, "matchCriteriaId": "341E6313-20D5-44CB-9719-B20585DC5AD6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}