CVE-2024-4629
Sept. 16, 2024, 3:51 p.m.
Tags
CVSS Score
Products Impacted
| Vendor | Product | Versions |
|---|---|---|
| redhat |
|
|
Description
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
Weaknesses
CWE-837
Improper Enforcement of a Single, Unique Action
The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
CWE ID: 837Date
Published: Sept. 3, 2024, 8:15 p.m.
Last Modified: Sept. 16, 2024, 3:51 p.m.
Status : Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
secalert@redhat.com
CPEs
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | redhat | keycloak | / | / | / | / | / | / | / | / |
| a | redhat | build_of_keycloak | / | / | / | / | / | / | / | / |
| a | redhat | single_sign-on | - | / | / | / | text-only | / | / | / |
| a | redhat | single_sign-on | / | / | / | / | / | / | / | / |
| o | redhat | enterprise_linux | 7.0 | / | / | / | / | / | / | / |
| o | redhat | enterprise_linux | 8.0 | / | / | / | / | / | / | / |
| o | redhat | enterprise_linux | 9.0 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform | 4.11 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform | 4.12 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform_for_linuxone | 4.9 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform_for_linuxone | 4.10 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform_for_power | 4.9 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform_for_power | 4.10 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform_ibm_z_systems | 4.9 | / | / | / | / | / | / | / |
| a | redhat | openshift_container_platform_ibm_z_systems | 4.10 | / | / | / | / | / | / | / |
| o | redhat | enterprise_linux | 8.0 | / | / | / | / | / | / | / |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Base Score
Exploitability Score
Impact Score
Base Severity
MEDIUMCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N