A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2023:7854 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:7855 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:7856 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:7857 | Exploit Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:7858 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:7860 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:7861 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2024:0798 | |
https://access.redhat.com/errata/RHSA-2024:0799 | |
https://access.redhat.com/errata/RHSA-2024:0800 | |
https://access.redhat.com/errata/RHSA-2024:0801 | |
https://access.redhat.com/errata/RHSA-2024:0804 | |
https://access.redhat.com/security/cve/CVE-2023-6134 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2249673 | Issue Tracking |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2023-12-14T21:42:12.160Z
Updated: 2024-06-12T10:09:11.941Z
Reserved: 2023-11-14T18:50:13.535Z
Link: CVE-2023-6134
JSON object: View
NVD Information
Status : Modified
Published: 2023-12-14T22:15:44.087
Modified: 2024-02-14T03:15:14.013
Link: CVE-2023-6134
JSON object: View
Redhat Information
No data.
CWE