CVE-2023-6134
Medium
Description
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
SeverityMedium
CVSS4.6
Exploit probability—
Product
Redhat Keycloak
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- redhat keycloak22.0.7 or later
- redhat single_sign-on7.6 or later
- org.keycloak:keycloak-services23.0.3 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2023:7854
- access.redhat.com/errata/RHSA-2023:7855
- access.redhat.com/errata/RHSA-2023:7856
- access.redhat.com/errata/RHSA-2023:7857
- access.redhat.com/errata/RHSA-2023:7858
- access.redhat.com/errata/RHSA-2023:7860
- access.redhat.com/errata/RHSA-2023:7861
- access.redhat.com/errata/RHSA-2024:0798
- access.redhat.com/errata/RHSA-2024:0799
- access.redhat.com/errata/RHSA-2024:0800
- access.redhat.com/errata/RHSA-2024:0801
- access.redhat.com/errata/RHSA-2024:0804
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | v < 22.0.7 | 22.0.7 |
| redhat single_sign-on | v < 7.6, No range specified | 7.6 |
| redhat openshift_container_platform | 4.11, 4.12 | — |
| redhat openshift_container_platform_for_power | 4.9, 4.10 | — |
| redhat openshift_container_platform_ibm_z_systems | 4.9, 4.10 | — |
| org.keycloak:keycloak-servicesMaven | v < 23.0.3 | 23.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.