CVE-2023-24457: CSRF
Published Jan 24, 2023
·Updated
A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected Software
2 affected componentsFixes available
maven/org.jenkins-ci.plugins:keycloak<=2.3.0
2.3.1
Jenkins Keycloak Authentication Jenkins<=2.3.0
Event History
Jan 24, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Jan 26, 2023
Advisory Published
09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-24457?
CVE-2023-24457 is classified as a cross-site request forgery (CSRF) vulnerability with a high risk of exploitation.
2
How do I fix CVE-2023-24457?
To remediate CVE-2023-24457, upgrade the Jenkins Keycloak Authentication Plugin to version 2.3.1 or later.
3
What versions of Jenkins Keycloak Authentication Plugin are affected by CVE-2023-24457?
CVE-2023-24457 affects Jenkins Keycloak Authentication Plugin versions 2.3.0 and earlier.
4
What can an attacker achieve by exploiting CVE-2023-24457?
An attacker can trick users into logging into the attacker's account through the CSRF vulnerability in CVE-2023-24457.
5
Is there a specific configuration to prevent CVE-2023-24457?
Simply updating to the fixed version is the primary way to prevent exploitation of CVE-2023-24457.