Keycloak's admin API allows low privilege users to use administrative functions
Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-3656US | — | Exploit | ||
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform a… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2024:3572WEB
- https://access.redhat.com/errata/RHSA-2024:3575WEB
- https://access.redhat.com/security/cve/CVE-2024-3656WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2274403WEB
- https://github.com/advisories/GHSA-2cww-fgmg-4jqcADVISORY
- https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.mdWEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan