CVE-2023-0657
Raw vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-0657 is a low-severity Improper Check for Dropped Privileges (CWE-273) vulnerability. Its CVSS base score is 3.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1142
Vulnerability Data
A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data…
more
outside of enforced permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employing least privilege requires that privilege-dropping operations succeed and are verified before continuing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege policy and enforcement directly motivate privilege-dropping code, yet the control does not address implementation-level verification of the drop.
Secure SDLC activities (code review, static analysis, testing) catch missing or incorrect privilege-drop checks, but eliminating only this one flaw covers only a fraction of the control's broader intent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining policies, determining requirements, and referencing other controls for implementing access rules; it never mandates or performs the specific check for successful privilege drop that would remove CWE-273 from first-party code.
A.5.18 governs the provisioning, review, and revocation of access rights granted to identities; it does not remove or mandate the removal of a first-party code defect in which a privilege drop is attempted but never verified.
Control of privileged utility programs includes ensuring privilege-dropping operations are verified before use.
A.8.2 controls the allocation, review, expiry and use of privileged rights via authorization and policy; it does not remove the code-level defect in which a drop-privileges call is performed without checking its success