CVE-2024-10492 Vulnerability Details

  /     /     /  

CVE-2024-10492 Metadata Quick Info

CVE Published: 25/11/2024 | CVE Updated: 27/11/2024 | CVE Year: 2024
Source: redhat | Vendor: Red Hat | Product: Red Hat build of Keycloak 24
Status : PUBLISHED

---

CVE-2024-10492 Description

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-73
CWE Name: External Control of File Name or Path
Source: Red Hat

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).