Advisory details:
github_osv / GHSA-m6q9-p373-g5q8
| Advisory ID | github_osv/GHSA-m6q9-p373-g5q8 |
| Aliases |
CVE-2024-1249
|
| Summary | Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. #### Acknowledgements Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.7 |
| Risk | 3.4 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-346 | Origin Validation Error |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.4 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-m6q9-p373-g5q8/GHSA-m6q9-p373-g5q8.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T17:33:02Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/1xxx/CVE-2024-1249.json
Source Advisory: vulnrichment/CVE-2024-1249
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]