← CVE Intelligence

CVE-2024-1249

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos PUBLISHED

Description (CNA)

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 21.1.0 before 22.0.10; affected 23.0.0 before 24.0.3
Red Hat / Red Hat AMQ Broker 7unaffected
Red Hat / Red Hat build of Keycloak 22unaffected 22.0.10-1 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-13 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-16 before *
Red Hat / Red Hat build of Keycloak 22.0.10unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.13-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.13-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.13-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-46 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-3 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHOSS-1.33-RHEL-8unaffected 1.33.0-5 before *
Red Hat / RHSSO 7.6.8unaffected
Red Hat / Migration Toolkit for Applications 6affected
Red Hat / Migration Toolkit for Applications 7unaffected
Red Hat / Red Hat build of Apicurio Registry 2affected
Red Hat / Red Hat Data Grid 8unaffected
Red Hat / Red Hat Decision Manager 7affected
Red Hat / Red Hat Developer Hubunaffected
Red Hat / Red Hat Fuse 7unaffected
Red Hat / Red Hat JBoss Data Grid 7unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 6unknown
Red Hat / Red Hat JBoss Enterprise Application Platform 7affected
Red Hat / Red Hat JBoss Enterprise Application Platform 8unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packunaffected
Red Hat / Red Hat Process Automation 7affected
Red Hat / streams for Apache Kafkaunaffected

CWE

CWE-346

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.