CVE-2023-6134

CVSS V2 None CVSS V3 None
Description
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
Overview
  • CVE ID
  • CVE-2023-6134
  • Assigner
  • redhat
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-12-14T21:42:12.160Z
  • Last Modified Date
  • 2024-06-12T10:09:11.941Z
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
References
Reference URL Reference Tags
https://access.redhat.com/errata/RHSA-2023:7854 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7855 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7856 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7857 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7858 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7860 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7861 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0798 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0799 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0800 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0801 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:0804 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-6134 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2249673 issue-tracking x_refsource_REDHAT
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-6134
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6134
History
Created Old Value New Value Data Type Notes
2024-06-25 06:04:00 Added to TrackCVE