CVE-2024-1249
Published: Apr 17, 2024
Modified: Jun 2, 2026
CVSS v3.1
7.4
Description
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.
| Vendor | Product | Versions |
|---|---|---|
Unknown | keycloak | affected 21.1.0 - < 22.0.10affected 23.0.0 - < 24.0.3 |
Red Hat | Red Hat AMQ Broker 7 | All versions |
Red Hat | Red Hat build of Keycloak 22 | unaffected 22.0.10-1 - < * |
Red Hat | Red Hat build of Keycloak 22 | unaffected 22-13 - < * |
Red Hat | Red Hat build of Keycloak 22 | unaffected 22-16 - < * |
Red Hat | Red Hat build of Keycloak 22.0.10 | All versions |
Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | unaffected 0:18.0.13-1.redhat_00001.1.el7sso - < * |
Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | unaffected 0:18.0.13-1.redhat_00001.1.el8sso - < * |
Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | unaffected 0:18.0.13-1.redhat_00001.1.el9sso - < * |
Red Hat | RHEL-8 based Middleware Containers | unaffected 7.6-46 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-3 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 - < * |
Red Hat | RHSSO 7.6.8 | All versions |
Red Hat | Migration Toolkit for Applications 6 | All versions |
Red Hat | Migration Toolkit for Applications 7 | All versions |
Red Hat | Red Hat build of Apicurio Registry 2 | All versions |
Red Hat | Red Hat Data Grid 8 | All versions |
Red Hat | Red Hat Decision Manager 7 | All versions |
Red Hat | Red Hat Developer Hub | All versions |
Red Hat | Red Hat Fuse 7 | All versions |
Red Hat | Red Hat JBoss Data Grid 7 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 6 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 7 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 8 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All versions |
Red Hat | Red Hat Process Automation 7 | All versions |
Red Hat | streams for Apache Kafka | All versions |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now