CVE-2024-10451

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-10451

Katalog CVE

CVSS 5.9 · Medium EPSS 0,92%

Kerentanan Use of Hard-coded Credentials. Skor CVSS 3.1 5.9 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.

Rincian

Terbit di NVD
25 November 2024
Terakhir diubah
21 September 2026
Status NVD
Deferred
CVSS 3.1
5.9 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-798: Use of Hard-coded Credentials
EPSS (30 hari)
0,92% peluang dieksploitasi; lebih tinggi dari 59,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.