CVE-2023-0091

{"id": "CVE-2023-0091", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "published": "2023-01-13T06:15:11.930", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-0091", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-0091", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Keycloak, donde no verific\u00f3 adecuadamente los tokens de los clientes para detectar una posible revocaci\u00f3n en su flujo de credenciales de cliente. Esta falla permite a un atacante acceder o modificar informaci\u00f3n potencialmente confidencial."}], "lastModified": "2024-11-21T07:36:32.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E0DE4E1-5D8D-40F3-8AC8-C7F736966158"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secalert@redhat.com"}