1. Home
  2. Vulnerabilities
  3. CVE-2023-6291

CVE-2023-6291

CVSS v3.1 7.1 (High)
71% Progress
EPSS 0.14 % (51th)
0.14% Progress
Affected Products 8
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Weaknesses
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
Related CVEs
CVE Status
PUBLISHED
CNA
Red Hat, Inc.
Published Date
2024-01-26 15:15:08
(7 months ago)
Updated Date
2024-02-14 03:15:14
(7 months ago)

Affected Products

Redhat

Configuration #1

    CPE23 From Up To
  Redhat Keycloak prior 22.0.7 version cpe:2.3:a:redhat:keycloak < 22.0.7
  Redhat Single Sign-on cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only

Configuration #2

AND
    CPE23 From Up To
OR  
  Redhat Openshift Container Platform 4.11 cpe:2.3:a:redhat:openshift_container_platform:4.11
OR  
  Running on/with
  Redhat Openshift Container Platform 4.12 cpe:2.3:a:redhat:openshift_container_platform:4.12
OR  
  Running on/with
  Redhat Openshift Container Platform for Ibm Z 4.9 cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9
OR  
  Running on/with
  Redhat Openshift Container Platform for Ibm Z 4.10 cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10
OR  
  Running on/with
  Redhat Openshift Container Platform for Linuxone 4.9 cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9
OR  
  Running on/with
  Redhat Openshift Container Platform for Linuxone 4.10 cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10
OR  
  Running on/with
  Redhat Openshift Container Platform for Power 4.9 cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9
OR  
  Running on/with
  Redhat Openshift Container Platform for Power 4.10 cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10
OR  
  Running on/with
  Redhat Enterprise Linux 8.0 cpe:2.3:o:redhat:enterprise_linux:8.0

Configuration #3

AND
    CPE23 From Up To
OR  
  Redhat Single Sign-on 7.6 cpe:2.3:a:redhat:single_sign-on:7.6
OR  
  Running on/with
  Redhat Enterprise Linux 7.0 cpe:2.3:o:redhat:enterprise_linux:7.0
OR  
  Running on/with
  Redhat Enterprise Linux 8.0 cpe:2.3:o:redhat:enterprise_linux:8.0
OR  
  Running on/with
  Redhat Enterprise Linux 9.0 cpe:2.3:o:redhat:enterprise_linux:9.0

Configuration #4

    CPE23 From Up To
  Redhat Migration Toolkit for Applications 6.0 cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0
  Redhat Migration Toolkit for Applications 7.0 cpe:2.3:a:redhat:migration_toolkit_for_applications:7.0