CVE-2024-7341
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
Severity Score
7.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-07-31 CVE Reserved
- 2024-09-09 CVE Published
- 2024-10-05 EPSS Updated
- 2024-12-31 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-384: Session Fixation
CAPEC
References (11)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2024:6493 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6494 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6495 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6497 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6499 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6500 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6501 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6502 | 2024-09-09 | |
| https://access.redhat.com/errata/RHSA-2024:6503 | 2024-09-09 | |
| https://access.redhat.com/security/cve/CVE-2024-7341 | 2024-09-09 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2302064 | 2024-09-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Build Keycloak Search vendor "Redhat" for product "Build Keycloak" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Build Of Keycloak Search vendor "Redhat" for product "Build Of Keycloak" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Keycloak Search vendor "Redhat" for product "Keycloak" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Red Hat Single Sign On Search vendor "Redhat" for product "Red Hat Single Sign On" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Rhosemc Search vendor "Redhat" for product "Rhosemc" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Single Sign-on Search vendor "Redhat" for product "Single Sign-on" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | * | - |
Affected
| ||||||