An information disclosure vulnerability exists in the... · CVE-2023-49594 · GitHub Advisory Database · GitHub

An information disclosure vulnerability exists in the...

Moderate severity Unreviewed Published Dec 23, 2023 to the GitHub Advisory Database • Updated Dec 23, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. An user login to Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.

References

Published by the National Vulnerability Database

Dec 23, 2023

Published to the GitHub Advisory Database Dec 23, 2023

Last updated Dec 23, 2023

Severity

Moderate

4.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N