Yüksek CVSS 7.1
CVE-2023-6291: Keycloak: açık yönlendirme
Açıklama (NVD)
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
Özet bilgiler
- Ürün
- Redhat Keycloak
- CVSS v3.1
- 7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - EPSS
- %0,95 (yüzdelik 61)
- CWE
- CWE-601
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-keycloak | — | — | 22.0.7 |
| redhat-single-sign-on | — | — | — |
| redhat-openshift-container-platform | 4.11 | 4.11 | — |
| redhat-openshift-container-platform | 4.12 | 4.12 | — |
| redhat-openshift-container-platform-for-ibm-z | 4.9 | 4.9 | — |
| redhat-openshift-container-platform-for-ibm-z | 4.10 | 4.10 | — |
| redhat-openshift-container-platform-for-linuxone | 4.9 | 4.9 | — |
| redhat-openshift-container-platform-for-linuxone | 4.10 | 4.10 | — |
| redhat-openshift-container-platform-for-power | 4.9 | 4.9 | — |
| redhat-openshift-container-platform-for-power | 4.10 | 4.10 | — |
| redhat-single-sign-on | 7.6 | 7.6 | — |
| redhat-migration-toolkit-for-applications | 6.0 | 6.0 | — |
| redhat-migration-toolkit-for-applications | 7.0 | 7.0 | — |
Kaynaklar
- NVD kaydı
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- CWE-601