CVE-2024-1132

{"id": "CVE-2024-1132", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-04-17T14:15:07.953", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1860", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1861", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1862", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1864", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1866", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1867", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1868", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2945", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:3752", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:3762", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1132", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262117", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Keycloak, donde no valida correctamente las URL incluidas en una redirecci\u00f3n. Este problema podr\u00eda permitir a un atacante crear una solicitud maliciosa para eludir la validaci\u00f3n y acceder a otras URL e informaci\u00f3n confidencial dentro del dominio o realizar m\u00e1s ataques. Esta falla afecta a cualquier cliente que utilice un comod\u00edn en el campo URI de redireccionamiento v\u00e1lido y requiere la interacci\u00f3n del usuario dentro de la URL maliciosa."}], "lastModified": "2024-06-12T08:15:49.457", "sourceIdentifier": "secalert@redhat.com"}