« Volver al listado

CVE-2024-12369

Estado: AplazadaMedia (4.2)—

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Redhat — Jboss Enterprise Application PlatformAIRedhat — Oidc ClientAIRedhat — Single Sign ONAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-12369",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-12369",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-10T15:29:39.382723Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "34.0.1.Final"
            }
          ],
          "packageName": "wildfly",
          "collectionURL": "https://github.com/wildfly/wildfly",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "packageName": "org.wildfly/wildfly-elytron-oidc-client-subsystem",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.16.1-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-apache-commons-io",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.80.0-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-bouncycastle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:800.7.0-2.GA_redhat_00002.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-eap-product-conf-parent",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:6.2.35-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-hibernate",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.0.13-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-ironjacamar",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.0.1-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jakarta-enterprise-concurrent",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.11-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jsf-impl",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.0.4-3.redhat_00004.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-reactive-streams",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.1.10-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-reactivex-rxjava",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.1.5-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-weld-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:8.0.7-3.GA_redhat_00004.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.9-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-elytron",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "packageName": "wildfly-elytron-oidc-client-subsystem",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "packageName": "org.wildfly/wildfly-elytron-oidc-client-subsystem",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-12-09T21:15:08.203",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:3989",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:3990",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:3992",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-12369",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331178",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/wildfly-security/wildfly-elytron/pull/2253",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/wildfly-security/wildfly-elytron/pull/2261",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en OIDC-Client. Al utilizar el adaptador RH SSO OIDC con EAP 7.x o al utilizar el subsistema elytron-oidc-client con EAP 8.x, pueden producirse ataques de inyección de código de autorización, lo que permite a un atacante inyectar un código de autorización robado en la propia sesión del atacante con el cliente con la identidad de la víctima. Esto suele hacerse con un ataque de tipo Man-in-the-Middle (MitM) o de phishing."
    }
  ],
  "lastModified": "2026-08-04T14:16:28.933",
  "sourceIdentifier": "secalert@redhat.com"
}