GET

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

GET /api/vulnerabilities/47506?format=api
HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47506?format=api",
    "vulnerability_id": "VCID-uya7-2sk1-6uat",
    "summary": "Keycloak secondary factor bypass in step-up authentication\nKeycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.",
    "aliases": [
        {
            "alias": "CVE-2023-3597"
        },
        {
            "alias": "GHSA-4f53-xh3v-g8x4"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/69809?format=api",
            "purl": "pkg:maven/org.keycloak/keycloak-services@22.0.10",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@22.0.10"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/69810?format=api",
            "purl": "pkg:maven/org.keycloak/keycloak-services@24.0.3",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@24.0.3"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/68192?format=api",
            "purl": "pkg:maven/org.keycloak/keycloak-services@23.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-2kyy-pzzx-n7gr"
                },
                {
                    "vulnerability": "VCID-2xvq-t8jp-zfbj"
                },
                {
                    "vulnerability": "VCID-66zv-ra8w-s3b4"
                },
                {
                    "vulnerability": "VCID-cs4b-u9hn-9ugy"
                },
                {
                    "vulnerability": "VCID-dt1x-6344-fkda"
                },
                {
                    "vulnerability": "VCID-ghak-3963-juhk"
                },
                {
                    "vulnerability": "VCID-kbc1-6psh-17d8"
                },
                {
                    "vulnerability": "VCID-mt5g-24m9-tfbg"
                },
                {
                    "vulnerability": "VCID-nw1y-zwsy-auff"
                },
                {
                    "vulnerability": "VCID-uya7-2sk1-6uat"
                },
                {
                    "vulnerability": "VCID-w6nc-88yg-dkem"
                },
                {
                    "vulnerability": "VCID-y5qk-qy59-23hn"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@23.0.0"
        }
    ],
    "references": [
        {
            "reference_url": "https://access.redhat.com/errata/RHSA-2024:1866",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1866"
        },
        {
            "reference_url": "https://access.redhat.com/errata/RHSA-2024:1867",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1867"
        },
        {
            "reference_url": "https://access.redhat.com/errata/RHSA-2024:1868",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1868"
        },
        {
            "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-3597.json",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                }
            ],
            "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-3597.json"
        },
        {
            "reference_url": "https://access.redhat.com/security/cve/CVE-2023-3597",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-3597"
        },
        {
            "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2221760",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2221760"
        },
        {
            "reference_url": "https://github.com/keycloak/keycloak",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/keycloak/keycloak"
        },
        {
            "reference_url": "https://github.com/keycloak/keycloak/commit/aa634aee882892960a526e49982806e103c8a432",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/keycloak/keycloak/commit/aa634aee882892960a526e49982806e103c8a432"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3597",
            "reference_id": "CVE-2023-3597",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3597"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-4f53-xh3v-g8x4",
            "reference_id": "GHSA-4f53-xh3v-g8x4",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-4f53-xh3v-g8x4"
        },
        {
            "reference_url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-4f53-xh3v-g8x4",
            "reference_id": "GHSA-4f53-xh3v-g8x4",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.0",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-4f53-xh3v-g8x4"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 287,
            "name": "Improper Authentication",
            "description": "When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct."
        },
        {
            "cwe_id": 288,
            "name": "Authentication Bypass Using an Alternate Path or Channel",
            "description": "A product requires authentication, but the product has an alternate path or channel that does not require authentication."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        },
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        }
    ],
    "exploits": [],
    "severity_range_score": "4.0 - 6.9",
    "exploitability": "0.5",
    "weighted_severity": "6.2",
    "risk_score": 3.1,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uya7-2sk1-6uat"
}