CVE-2024-0560

Medium

Description

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

SeverityMedium

CVSS6.3

Exploit probability—

Product

Redhat 3scale

PublishedFeb 28, 2024

First seenFeb 28, 2024

Weakness typeCWE-280CWE-280

How to fix

Patches

github.com/3scale/APIcast/pull/1438

Vendor advisories

access.redhat.com/security/cve/CVE-2024-0560
bugzilla.redhat.com/show_bug.cgi?id=2258456

Affected products

Product	Affected versions	Fixed in
redhat 3scale	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.