VulnerabilityDeferred

CVE-2024-8698

This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

HIGH 7.7EPSS 2.03%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS: 2.03% probability · 80th percentile
CISA KEV: Not listed
Weakness: CWE-347
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.