Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2023-6291

Опубликовано: 26 янв. 2024
Источник: nvd
CVSS3: 7.1
EPSS Низкий

Описание

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
Версия до 22.0.7 (исключая)
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
Конфигурация 2

Одновременно

Одно из

cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Конфигурация 3

Одновременно

cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Конфигурация 4

Одно из

cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_applications:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 42%
0.00196
Низкий

7.1 High

CVSS3

Дефекты

CWE-601
CWE-601

Связанные уязвимости

redhat логотип

CVE-2023-6291

CVSS3: 7.1
redhat
около 2 лет назад

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

debian логотип

CVE-2023-6291

CVSS3: 7.1
debian
около 2 лет назад

A flaw was found in the redirect_uri validation logic in Keycloak. Thi ...

github логотип

GHSA-mpwq-j3xf-7m5w

CVSS3: 7.1
github
около 2 лет назад

The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted

EPSS

Процентиль: 42%
0.00196
Низкий

7.1 High

CVSS3

Дефекты

CWE-601
CWE-601