Search for vulnerabilities
Vulnerability details: VCID-6y2h-e36u-aaak
Vulnerability ID VCID-6y2h-e36u-aaak
Aliases CVE-2024-3656
GHSA-2cww-fgmg-4jqc
Summary Keycloak's admin API allows low privilege users to use administrative functions Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-269 Improper Privilege Management
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2024:3572
generic_textual HIGH https://access.redhat.com/errata/RHSA-2024:3572
ssvc Track https://access.redhat.com/errata/RHSA-2024:3572
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2024:3575
generic_textual HIGH https://access.redhat.com/errata/RHSA-2024:3575
ssvc Track https://access.redhat.com/errata/RHSA-2024:3575
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3656.json
cvssv3.1 8.1 https://access.redhat.com/security/cve/CVE-2024-3656
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2024-3656
ssvc Track https://access.redhat.com/security/cve/CVE-2024-3656
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00090 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00090 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.00779 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.65506 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.65506 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.65506 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.65506 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.65506 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.65506 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.69818 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.78189 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.79925 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.80674 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.8134 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
epss 0.81815 https://api.first.org/data/v1/epss?cve=CVE-2024-3656
cvssv3.1 8.1 https://bugzilla.redhat.com/show_bug.cgi?id=2274403
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=2274403
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2274403
cvssv3.1 8.1 https://github.com/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-2cww-fgmg-4jqc
generic_textual HIGH https://github.com/advisories/GHSA-2cww-fgmg-4jqc
ssvc Track https://github.com/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1 8.1 https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
generic_textual HIGH https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
cvssv3.1 6.8 https://github.com/keycloak/keycloak
cvssv3.1 8.1 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 8.1 https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
generic_textual HIGH https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
cvssv3.1 8.1 https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1_qr HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
generic_textual HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
cvssv3.1 8.1 https://news.ycombinator.com/item?id=42136000
generic_textual HIGH https://news.ycombinator.com/item?id=42136000
cvssv3 8.1 https://nvd.nist.gov/vuln/detail/CVE-2024-3656
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2024-3656
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-3656
cvssv3.1 8.1 https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
generic_textual HIGH https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3656.json
https://api.first.org/data/v1/epss?cve=CVE-2024-3656
https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
https://news.ycombinator.com/item?id=42136000
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/
cpe:/a:redhat:build_keycloak: https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:build_keycloak:22 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22
cpe:/a:redhat:jboss_enterprise_application_platform:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:red_hat_single_sign_on:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/a:redhat:red_hat_single_sign_on:7.6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6
CVE-2024-3656 https://access.redhat.com/security/cve/CVE-2024-3656
CVE-2024-3656 https://nvd.nist.gov/vuln/detail/CVE-2024-3656
GHSA-2cww-fgmg-4jqc https://github.com/advisories/GHSA-2cww-fgmg-4jqc
RHSA-2024:3572 https://access.redhat.com/errata/RHSA-2024:3572
RHSA-2024:3575 https://access.redhat.com/errata/RHSA-2024:3575
show_bug.cgi?id=2274403 https://bugzilla.redhat.com/show_bug.cgi?id=2274403
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2024:3572
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://access.redhat.com/errata/RHSA-2024:3572
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2024:3575
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://access.redhat.com/errata/RHSA-2024:3575
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3656.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2024-3656
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://access.redhat.com/security/cve/CVE-2024-3656
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2274403
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2274403
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/advisories/GHSA-2cww-fgmg-4jqc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-09T19:18:03Z/ Found at https://github.com/advisories/GHSA-2cww-fgmg-4jqc
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://news.ycombinator.com/item?id=42136000
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-3656
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-3656
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.30316
EPSS Score 0.00065
Published At Dec. 19, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-06-11T20:53:13.972808+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-2cww-fgmg-4jqc/GHSA-2cww-fgmg-4jqc.json 34.0.0rc4