A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Metrics
Affected Vendors & Products
References
History
Wed, 13 Nov 2024 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2024-06-03T15:33:18.191Z
Updated: 2024-11-13T14:26:26.123Z
Reserved: 2024-05-06T11:02:39.841Z
Link: CVE-2024-4540
Vulnrichment
Updated: 2024-08-01T20:40:47.507Z
NVD
Status : Awaiting Analysis
Published: 2024-06-03T16:15:08.993
Modified: 2024-11-21T09:43:04.063
Link: CVE-2024-4540
Redhat