CVE-2023-49594

Katalog CVE

CVSS 6.5 · Medium EPSS 1,2%

Kerentanan Insertion of Sensitive Information Into Sent Data pada michaelkelly duouniversalkeycloakauthenticator. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.

Rincian

Terbit di NVD

23 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1907 exploit · advisory pihak ketiga
• https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8 release notes
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1907