PT-2023-32538 · Red Hat · Keycloak

Chess Hazlett · Published 2023-12-14 · Updated 2024-02-14 · CVE-2023-6134

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. The flaw is the result of an incomplete fix for a previous issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

CWE-75

Related Identifiers

CVE-2023-6134

GHSA-5968-QW33-H47J

GHSA-CVG2-7C3J-G36J

RHSA-2023:7854

RHSA-2023:7855

RHSA-2023:7856

RHSA-2024:0798

RHSA-2024:0799

RHSA-2024:0800

Affected Products

Keycloak

References · 28

• 🔥 https://access.redhat.com/errata/RHSA-2023:7857 · Exploit
• https://access.redhat.com/errata/RHSA-2024:0804 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:0798 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5968-qw33-h47j · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:0800 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7861 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7858 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cvg2-7c3j-g36j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6134 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6134 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7860 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-6134 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7854 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7856 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7855 · Vendor Advisory