Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-GC7Q-JGJV-VJR2
HistorySep 17, 2024 - 10:29 p.m.

Keycloak Services has a potential bypass of brute force protection

2024-09-1722:29:01
CWE-307
CWE-837
GitHub Advisory Database
github.com
keycloak
brute force protection
bypass
parallel login
security issue
acknowledgements
maurizio agazzini
project improvement
software

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.8

Confidence

Low

JSON

If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.

Acknowledgements:
Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

Affected configurations

Vulners
Node
org.keycloak\keycloakMatchservices
OR
org.keycloak\keycloakMatchservices
OR
org.keycloak\keycloakMatchservices
OR
org.keycloak\keycloakMatchservices
VendorProductVersionCPE
org.keycloak\keycloakservicescpe:2.3:a:org.keycloak\:keycloak:services:*:*:*:*:*:*:*:*

References

Related

nvd 1
cvelist 1
cve 1
vulnrichment 1
osv 3
redhatcve 1
redhat 7
nessus 3
nvd
nvd
CVE-2024-4629
2024-09-03 20:15:09
cvelist
cvelist
CVE-2024-4629 Keycloak: potential bypass of brute force protection
2024-09-03 19:42:01
cve
cve
CVE-2024-4629
2024-09-03 20:15:09
vulnrichment
vulnrichment
CVE-2024-4629 Keycloak: potential bypass of brute force protection
2024-09-03 19:42:01
osv
osv
Keycloak has a brute force login protection bypass
2024-09-03 21:31:12
Keycloak Services has a potential bypass of brute force protection
2024-09-17 22:29:01
CVE-2024-4629
2024-09-03 20:15:09
redhatcve
redhatcve
CVE-2024-4629
2024-09-03 19:41:46
redhat
redhat
(RHSA-2024:6500) Moderate: Red Hat build of Keycloak 22.0.12 Images Update
2024-09-09 15:41:41
(RHSA-2024:6499) Moderate: Red Hat Single Sign-On 7.6.10 security update
2024-09-09 15:37:10
(RHSA-2024:6495) Moderate: Red Hat Single Sign-On 7.6.10 security update on RHEL 9
2024-09-09 15:27:35
nessus
nessus
RHEL 7 : Red Hat Single Sign-On 7.6.10 security update on RHEL 7 (Moderate) (RHSA-2024:6493)
2024-09-09 00:00:00
RHEL 8 : Red Hat Single Sign-On 7.6.10 security update on RHEL 8 (Moderate) (RHSA-2024:6494)
2024-09-09 00:00:00
RHEL 9 : Red Hat Single Sign-On 7.6.10 security update on RHEL 9 (Moderate) (RHSA-2024:6495)
2024-09-09 00:00:00

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.8

Confidence

Low

JSON
Related for GHSA-GC7Q-JGJV-VJR2
nvd1cvelist1cve1vulnrichment1osv3redhatcve1redhat7nessus3