CVE-2024-12369

Aliases:GHSA-5565-3c98-g6jcCGA-455v-xqwc-84wpCGA-6jcq-73cx-r8mfCGA-78p5-j268-74hhCGA-97p2-8jm9-8gf8CGA-j9j8-vfrq-86c4CGA-jh6m-xqf3-m65mCGA-jx98-wwx3-45chCGA-p6c9-23j7-xcphCGA-pqfc-hjcv-px58CGA-wg7c-3p3r-mcfp
Advisory lineage Upstream: 0 Downstream: 2
Deferred
Published: 09 Dec 2024, 20:53
Last modified:04 Aug 2026, 13:38

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.2 MEDIUM
v3.1 (cve.org)
EPSS Score
0.24% LOW
0% probability -0.07%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Dec 2024, 20:53
Published
Vulnerability first disclosed
04 Aug 2026, 13:38
Last Modified
Vulnerability information updated

Description

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.2CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 16%

Techniques & Countermeasures

  • CWE-345•Insufficient Verification of Data Authenticity

    The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Systems

  • chainguard•wildfly

    < 35.0.1-r16

  • chainguard•wildfly-openjdk-17

    < 35.0.1-r16

  • chainguard•wildfly-openjdk-17-compat

    < 35.0.1-r16

  • chainguard•wildfly-openjdk-21

    < 35.0.1-r16

  • chainguard•wildfly-openjdk-21-compat

    < 35.0.1-r16

  • wolfi•wildfly

    < 35.0.1-r16

  • wolfi•wildfly-openjdk-17

    < 35.0.1-r16

  • wolfi•wildfly-openjdk-17-compat

    < 35.0.1-r16

  • wolfi•wildfly-openjdk-21

    < 35.0.1-r16

  • wolfi•wildfly-openjdk-21-compat

    < 35.0.1-r16

  • org.wildfly.security•wildfly-elytron

    ≥ 1.17.0.Final, < 2.2.9.Final | ≥ 2.3.0.Final, < 2.6.2.Final

  • org.wildfly.security•wildfly-elytron-http-oidc

    ≥ 1.17.0.Final, < 2.2.9.Final | ≥ 2.3.0.Final, < 2.6.2.Final

References (17)