CVE-2024-3656

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
redhatCNA
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2024:3572
https://access.redhat.com/errata/RHSA-2024:3575
https://access.redhat.com/security/cve/CVE-2024-3656
https://bugzilla.redhat.com/show_bug.cgi?id=2274403
https://github.com/advisories/GHSA-2cww-fgmg-4jqc
https://github.com/hnsecurity/vulns/blob/main/HNS-2024-08-Keycloak.md
https://news.ycombinator.com/item?id=42136000
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/