CVE-2024-0560: redhat 3scale

Vulnerability summary

CVE-2024-0560 is a medium (CVSS 6.3) vulnerability in redhat 3scale. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.8% of scored vulnerabilities.

Timeline

1. 28-02-2024
   PublishedVulnerability first disclosed.
2. 20-11-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

• CWE-280Improper Handling of Insufficient Permissions or PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.