Information disclosure in Keycloak - CVE-2024-11736
Published: January 13, 2025
Vulnerability identifier: #VU102570
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-11736
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to the application discloses values of environment variables via user-configurable URLs. A remote user can configure backchannel logout URLs or admin URLs with placeholders like ${env.VARNAME} or ${PROPNAME} and gain access to sensitive information.
Affected software
Keycloak
IBM Business Automation Manager Open Editions
Red Hat build of Keycloak
IBM Business Automation Manager Open Editions
Red Hat build of Keycloak
How to mitigate CVE-2024-11736
Install updates from vendor's website.
Keycloak - update to 26.0.8
IBM Business Automation Manager Open Editions - update to 9.2.1
Red Hat build of Keycloak - update to 26.0.8
IBM Business Automation Manager Open Editions - update to 9.2.1
Red Hat build of Keycloak - update to 26.0.8