PT-2024-5147 · Red Hat · Keycloak

Tej Rathi

·

Published

2024-04-16

·

Updated

2024-08-29

·

CVE-2023-6717

CVSS v2.0

6.8

Medium

VectorAV:N/AC:H/Au:S/C:C/I:C/A:P
Name of the Vulnerable Software and Affected Versions: Keycloak (affected versions not specified)
Description: A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. The vulnerability exists due to the lack of protection of the web page structure, which can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete Keycloak instance.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

RCE

XSS

Weakness Enumeration

CWE-601CWE-20CWE-79

Related Identifiers

BDU:2024-05694
CVE-2023-6717
GHSA-8RMM-GM28-PJ8Q

Affected Products

Keycloak