CVE-2024-4629
Last modified
CVE-2024-4629 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. EPSS estimates a 0.79% chance of exploitation in the next 30 days.
Description
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Keycloak | < 24.0.3 |
| Redhat | Build Of Keycloak | >= 22.0, < 22.012 |
| Redhat | Single Sign-On | All versions |
| Redhat | Single Sign-On | >= 7.6, < 7.6.10 |
| Redhat | Openshift Container Platform | 4.11 |
| Redhat | Openshift Container Platform | 4.12 |
| Redhat | Openshift Container Platform For Linuxone | 4.9 |
| Redhat | Openshift Container Platform For Linuxone | 4.10 |
| Redhat | Openshift Container Platform For Power | 4.9 |
| Redhat | Openshift Container Platform For Power | 4.10 |
| Redhat | Openshift Container Platform Ibm Z Systems | 4.9 |
| Redhat | Openshift Container Platform Ibm Z Systems | 4.10 |
References
- https://access.redhat.com/errata/RHSA-2024:6493Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:6494Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:6495Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:6497Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:6499Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:6500Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:6501Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-4629Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2276761Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-4629?
How severe is CVE-2024-4629?
How do I fix CVE-2024-4629?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-46267cute_png v1.05 was discovered to contain a heap buffer overf…7.8
- CVE-2024-4627The Rank Math SEO WordPress plugin before 1.0.219 does not …5.4
- CVE-2024-46274cute_png v1.05 was discovered to contain a heap buffer overf…7.8
- CVE-2024-46276cute_png v1.05 was discovered to contain a heap buffer overf…7.8
- CVE-2024-46278Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via t…8.4
- CVE-2024-46280PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improp…8.8
- CVE-2024-46292A buffer overflow in modsecurity v3.0.12 allows attackers to…7.5
- CVE-2024-46293Sourcecodester Online Medicine Ordering System 1.0 is vulner…9.8
- CVE-2024-4630The Starter Templates — Elementor, WordPress & Beaver Builde…6.4
- CVE-2024-46300itsourcecode Placement Management System 1.0 is vulnerable t…6.1
- CVE-2024-46304A NULL pointer dereference in libcoap v4.3.5-rc2 and below a…7.5
- CVE-2024-46307A loop hole in the payment logic of Sparkshop v1.16 allows a…7.5
Are you affected by CVE-2024-4629?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST