Products
Keycloak
Source
secalert@redhat.com
Tags
CVE-2024-7341 details
Published : Sept. 9, 2024, 7:15 p.m.
Last Modified : Sept. 9, 2024, 7:15 p.m.
Last Modified : Sept. 9, 2024, 7:15 p.m.
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.1 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-384 | Session Fixation | Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
7.1
Exploitability Score
1.2
Impact Score
5.9
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://access.redhat.com/errata/RHSA-2024:6493 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6494 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6495 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6497 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6499 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6500 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6501 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6502 | secalert@redhat.com |
| https://access.redhat.com/errata/RHSA-2024:6503 | secalert@redhat.com |
| https://access.redhat.com/security/cve/CVE-2024-7341 | secalert@redhat.com |
| https://bugzilla.redhat.com/show_bug.cgi?id=2302064 | secalert@redhat.com |
This website uses the NVD API, but is not approved or certified by it.