CVE-2023-6134
MEDIUM
4,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0190
Percentile
0,8th
Updated
EPSS Score Trend (Last 91 Days)
79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
StableCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Availability
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML, Web Based, Web Server
Application
Openshift Container Platform For Power by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Single Sign-On by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Openshift Container Platform by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Openshift Container Platform For Power by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Keycloak by Redhat
Version Range Affected
To
22.0.7
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Single Sign-On by Redhat
Version Range Affected
To
7.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Openshift Container Platform Ibm Z Systems by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Openshift Container Platform Ibm Z Systems by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Openshift Container Platform by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://access.redhat.com/errata/RHSA-2023:7854
https://access.redhat.com/errata/RHSA-2023:7855
https://access.redhat.com/errata/RHSA-2023:7856
https://access.redhat.com/errata/RHSA-2023:7857
https://access.redhat.com/errata/RHSA-2023:7858
https://access.redhat.com/errata/RHSA-2023:7860
https://access.redhat.com/errata/RHSA-2023:7861
https://access.redhat.com/errata/RHSA-2024:0798
https://access.redhat.com/errata/RHSA-2024:0799
https://access.redhat.com/errata/RHSA-2024:0800
https://access.redhat.com/errata/RHSA-2024:0801
https://access.redhat.com/errata/RHSA-2024:0804
https://access.redhat.com/security/cve/CVE-2023-6134
https://bugzilla.redhat.com/show_bug.cgi?id=2249673
https://access.redhat.com/errata/RHSA-2023:7854
https://access.redhat.com/errata/RHSA-2023:7855
https://access.redhat.com/errata/RHSA-2023:7856
https://access.redhat.com/errata/RHSA-2023:7857
https://access.redhat.com/errata/RHSA-2023:7858
https://access.redhat.com/errata/RHSA-2023:7860
https://access.redhat.com/errata/RHSA-2023:7861
https://access.redhat.com/errata/RHSA-2024:0798
https://access.redhat.com/errata/RHSA-2024:0799
https://access.redhat.com/errata/RHSA-2024:0800
https://access.redhat.com/errata/RHSA-2024:0801
https://access.redhat.com/errata/RHSA-2024:0804
https://access.redhat.com/security/cve/CVE-2023-6134
https://bugzilla.redhat.com/show_bug.cgi?id=2249673