cve-2024-5203
Vulnerability from cvelistv5

After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.

Show details on NVD website


{
   containers: {
      cna: {
         providerMetadata: {
            dateUpdated: "2024-09-13T10:15:30.617Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         rejectedReasons: [
            {
               lang: "en",
               value: "After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-5203",
      datePublished: "2024-06-12T08:51:59.518Z",
      dateRejected: "2024-09-13T10:15:30.617Z",
      dateReserved: "2024-05-22T15:10:01.533Z",
      dateUpdated: "2024-09-13T10:15:30.617Z",
      state: "REJECTED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         descriptions: "[{\"lang\": \"en\", \"value\": \"Rejected reason: After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.\"}]",
         id: "CVE-2024-5203",
         lastModified: "2024-09-13T11:15:10.197",
         published: "2024-06-12T09:15:20.647",
         sourceIdentifier: "secalert@redhat.com",
         vulnStatus: "Rejected",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2024-5203\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2024-06-12T09:15:20.647\",\"lastModified\":\"2024-09-13T11:15:10.197\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.\"}],\"metrics\":{},\"references\":[]}}",
      vulnrichment: {
         containers: "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"After careful review of CVE-2024-5203, it has been determined that the issue is not exploitable in real-world scenarios. Moreover, the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request.\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2024-09-13T10:15:30.617Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-5203\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"state\": \"REJECTED\", \"assignerShortName\": \"redhat\", \"dateReserved\": \"2024-05-22T15:10:01.533Z\", \"datePublished\": \"2024-06-12T08:51:59.518Z\", \"dateUpdated\": \"2024-09-13T10:15:30.617Z\", \"dateRejected\": \"2024-09-13T10:15:30.617Z\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.