VulnerabilityModified
CVE-2024-7341
This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
HIGH 7.1EPSS 0.85%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.85% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-384
- Affected
- redhat/keycloak · redhat/single sign-on · redhat/build of keycloak
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2024:6493Mailing List
- https://access.redhat.com/errata/RHSA-2024:6494Mailing List
- https://access.redhat.com/errata/RHSA-2024:6495Mailing List
- https://access.redhat.com/errata/RHSA-2024:6497Mailing List
- https://access.redhat.com/errata/RHSA-2024:6499Mailing List
- https://access.redhat.com/errata/RHSA-2024:6500Mailing List
- https://access.redhat.com/errata/RHSA-2024:6501Mailing List
- https://access.redhat.com/errata/RHSA-2024:6502Mailing List
- https://access.redhat.com/errata/RHSA-2024:6503Mailing List
- https://access.redhat.com/security/cve/CVE-2024-7341Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2302064Issue Tracking, Vendor Advisory
- https://github.com/advisories/GHSA-j76j-rqwj-jmvv
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.