Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-4540

Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

keycloak

  • d5e82356f90893ca3b308a7e10020103e402369a to < *unaffected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat build of Keycloak 22

Default version status: affected

  • 22.0.11-2 to < *unaffected

Red Hat Red Hat build of Keycloak 22

Default version status: affected

  • 22-15 to < *unaffected

Red Hat Red Hat build of Keycloak 22

Default version status: affected

  • 22-18 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

  • 24.0.5-2 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

  • 24-10 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

  • 24-10 to < *unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 7

Default version status: affected

  • 0:18.0.14-1.redhat_00001.1.el7sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 8

Default version status: affected

  • 0:18.0.14-1.redhat_00001.1.el8sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 9

Default version status: affected

  • 0:18.0.14-1.redhat_00001.1.el9sso to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.6-49 to < *unaffected

References