CVE-2024-12369 vulnerabilities

Vulnerabilities for packages: wildfly...

io.hawt:hawtio-wildfly (=2.17.7), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +133 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=1.17.0.Final <=2.2.8.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =1.17.0.Final, =0.1.0, =9.4.45.v20220203, =9.4.45.v20220203, =9.4.45.v20220203, =10.0.8, =12.0.1, =12.0.1, =12.0.1, =10.0.10, =13.0.0.CR1, =3.1.0.Final, =3.1.1.Alpha1 - org.jboss.resteasy.spring:galleon-feature-pack-layers-metadata-test...

de.gedoplan:baselibs-wildfly (=36.0.1_02), org.eclipse.jetty.documentation:code-examples (>=10.0.22 <=11.0.25) +18 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=2.3.0.Final <=2.6.1.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =2.3.0.Final, =10.0.22, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =26.0.0, =26.0.0, =26.0.0, =2.3.0.Final, =2.6.10.Final - org.wildfly.transaction:wildfly-transaction-client =3.0.5.Final and more Source cves: CVE-2024-12369 Sour...

br.eti.clairton:ds-test (>=1.0.1 <=1.2.1), br.unb.erlangms:ems_java (=1.0.8.8) +394 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron (>=1.17.0.Final <=2.2.7.Final)

org.wildfly.security:wildfly-elytron MAVEN version =1.17.0.Final, =1.0.1, =1.6.10, =1.6.10, =2020.10.30-4240, =2020.10.30-4240, =6.2.0, =0.1.0, =1.0.1, =6.3.0, =0.2.10-wildfly15, =0.2.10-wildfly15, =0.2, =0.3...

de.gedoplan:baselibs-wildfly (=36.0.1_02), org.eclipse.jetty.documentation:code-examples (>=10.0.22 <=11.0.25) +16 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron (>=2.3.0.Final <=2.6.0.Final)

org.wildfly.security:wildfly-elytron MAVEN version =2.3.0.Final, =10.0.22, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =10.0.21, =26.0.0, =26.0.0, =26.0.0, =2.1.0.Final, =2.1.4.Final and more Source cves: CVE-2024-12369 Source advisory: OSV:GHSA-5565-3C98-G6JC...

io.hawt:hawtio-wildfly (=2.17.7), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +133 more potentially affected by CVE-2024-12369 via org.wildfly.security:wildfly-elytron-http-oidc (>=1.17.0.Final <=2.2.8.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =1.17.0.Final, =0.1.0, =9.4.45.v20220203, =9.4.45.v20220203, =9.4.45.v20220203, =10.0.8, =12.0.1, =12.0.1, =12.0.1, =10.0.10, =13.0.0.CR1, =3.1.0.Final, =3.1.1.Alpha1 - org.jboss.resteasy.spring:galleon-feature-pack-layers-metadata-test...

CVE-2024-12369

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

CVE-2024-12369 Elytron-oidc-client: oidc authorization code injection

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

CVE-2024-12369

CVE-2024-12369 affects the OpenID Connect client integration in WildFly/JBoss EAP via the OIDC Client (ELY-OIDC) subsystem. The flaw allows an attacker to inject a stolen authorization code into their own session, effectively impersonating a victim, typically via MitM or phishing. Affected compon...