Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2023-6134

Опубликовано: 14 дек. 2023
Источник: nvd
CVSS3: 4.6
CVSS3: 5.4
EPSS Низкий

Описание

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
Версия до 7.6 (исключая)

Одно из

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
Версия до 22.0.7 (исключая)
Конфигурация 3

Одновременно

Одно из

cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Конфигурация 4

Одновременно

Одно из

cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Конфигурация 5

Одновременно

Одно из

cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Конфигурация 6
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

EPSS

Процентиль: 83%
0.01902
Низкий

4.6 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79
CWE-79

Связанные уязвимости

redhat логотип

CVE-2023-6134

CVSS3: 4.6
redhat
около 2 лет назад

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

debian логотип

CVE-2023-6134

CVSS3: 4.6
debian
около 2 лет назад

A flaw was found in Keycloak that prevents certain schemes in redirect ...

github логотип

GHSA-cvg2-7c3j-g36j

CVSS3: 4.6
github
около 2 лет назад

Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

EPSS

Процентиль: 83%
0.01902
Низкий

4.6 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79
CWE-79