CVE-2024-7341
High
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
SeverityHigh
CVSS7.1
Exploit probability58. percentile0.8%
Product
Redhat Keycloak
PublishedSep 9, 2024
First seenSep 9, 2024
Weakness typeCWE-384CWE-384
How to fix
Update
- redhat single_sign-on7.6.10 or later
- redhat build_of_keycloak22.0.12, 24.0.7 or later
- org.keycloak:keycloak-services22.0.12, 24.0.7, 25.0.5 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2024:6493
- access.redhat.com/errata/RHSA-2024:6494
- access.redhat.com/errata/RHSA-2024:6495
- access.redhat.com/errata/RHSA-2024:6497
- access.redhat.com/errata/RHSA-2024:6499
- access.redhat.com/errata/RHSA-2024:6500
- access.redhat.com/errata/RHSA-2024:6501
- access.redhat.com/errata/RHSA-2024:6502
- access.redhat.com/errata/RHSA-2024:6503
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | v ≤ 25.0.2 | — |
| redhat single_sign-on | 7.6 ≤ v < 7.6.10, No range specified | 7.6.10 |
| redhat build_of_keycloak | 22.0 ≤ v < 22.0.12, 24.0 ≤ v < 24.0.7 | 22.0.12, 24.0.7 |
| org.keycloak:keycloak-servicesMaven | v < 22.0.12, 23.0.0 ≤ v < 24.0.7, 25.0.0 ≤ v < 25.0.5 | 22.0.12, 24.0.7, 25.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.