← CVE Intelligence

CVE-2024-4540

Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie PUBLISHED

Description (CNA)

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedunaffected d5e82356f90893ca3b308a7e10020103e402369a before *
Red Hat / Red Hat Build of Keycloakunaffected
Red Hat / Red Hat Build of Keycloakunaffected
Red Hat / Red Hat build of Keycloak 22unaffected 22.0.11-2 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-15 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-18 before *
Red Hat / Red Hat build of Keycloak 24unaffected 24.0.5-2 before *
Red Hat / Red Hat build of Keycloak 24unaffected 24-10 before *
Red Hat / Red Hat build of Keycloak 24unaffected 24-10 before *
Red Hat / Red Hat Single Sign-On 7unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.14-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.14-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.14-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-49 before *

CWE

CWE-312

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.