RedhatCVELIST:CVE-2024-0560CVE-2024-0560 Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS
Percentile
15.5%
A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn’t inspect tokens, it determines that all tokens are valid.
CNA Affected
[
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.14.1",
"versionType": "semver"
}
],
"packageName": "APIcast",
"collectionURL": "https://github.com/3scale/APIcast",
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat 3scale API Management Platform 2",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "apicast",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
]
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS
Percentile
15.5%