CVE-2024-7318

Katalog CVE

CVSS 4.8 · Medium EPSS 0,39%

Kerentanan Use of a Key Past its Expiration Date pada redhat build of keycloak. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.

Rincian

Terbit di NVD

9 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-324: Use of a Key Past its Expiration Date

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2024-7318 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2301876 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2024:6502 issue tracking
• https://access.redhat.com/errata/RHSA-2024:6503 issue tracking