CVE-2024-10492
Nov. 25, 2024, 8:15 a.m.
2.7
Low
Description
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
Product(s) Impacted
| Product | Versions |
|---|---|
| Keycloak |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-73
External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
References
Tags
CVSS Score
CVSS Data - 3.0
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: HIGH
- Scope: UNCHANGED
- Confidentiality Impact: LOW
- Integrity Impact: NONE
- Availability Impact: NONE
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Timeline
Published: Nov. 25, 2024, 8:15 a.m.
Last Modified: Nov. 25, 2024, 8:15 a.m.
Last Modified: Nov. 25, 2024, 8:15 a.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
secalert@redhat.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.