-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the checkState function in login-status-iframe.html handling cross-origin messages. The commit diff shows the addition of 'preventAdditionalRequests' flag to limit requests, proving the original function lacked request throttling. The CWE-346 (Origin Validation Error) confirms missing origin checks. The function's role in session status checks and the patch's focus on request limiting directly correlate with the described DDoS vulnerability through unvalidated messages.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 22.0.10 | 22.0.10 |
| org.keycloak:keycloak-services | maven | >= 23.0.0, < 24.0.3 | 24.0.3 |
JavaJavaOngoing coverage of React2Shell