CVE-2024-0560

Katalog CVE

CVSS 4.3 · Medium EPSS 0,49%

Kerentanan Improper Handling of Insufficient Permissions or Privileges pada redhat 3scale. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

Rincian

Terbit di NVD

28 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-280: Improper Handling of Insufficient Permissions or Privileges

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2024-0560 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2258456 mitigasi · advisory vendor
• https://github.com/3scale/APIcast/pull/1438 patch