CVE-2023-6787

Katalog CVE

CVSS 8.8 · High EPSS 0,74%

Kerentanan Improper Authentication pada redhat build of keycloak, redhat keycloak. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.

Rincian

Terbit di NVD

25 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2024:1867 advisory vendor
• https://access.redhat.com/errata/RHSA-2024:1868 advisory vendor
• https://access.redhat.com/security/cve/CVE-2023-6787 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2254375 issue tracking · advisory vendor
• https://github.com/keycloak/keycloak/security/advisories/GHSA-c9h6-v78w-52wj advisory vendor