CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
Low
EPSS
Percentile
51.4%
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode “form_post.jwt” which could be used to bypass the security patch implemented to address CVE-2023-6134.
Vendor | Product | Version | CPE |
---|---|---|---|
org.keycloak | keycloak-parent | * | cpe:2.3:a:org.keycloak:keycloak-parent:*:*:*:*:*:*:*:* |
access.redhat.com/errata/RHSA-2024:0094
access.redhat.com/errata/RHSA-2024:0095
access.redhat.com/errata/RHSA-2024:0096
access.redhat.com/errata/RHSA-2024:0097
access.redhat.com/errata/RHSA-2024:0098
access.redhat.com/errata/RHSA-2024:0100
access.redhat.com/errata/RHSA-2024:0101
access.redhat.com/security/cve/CVE-2023-6927
bugzilla.redhat.com/show_bug.cgi?id=2255027
github.com/advisories/GHSA-3p75-q5cc-qmj7
nvd.nist.gov/vuln/detail/CVE-2023-6927
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
Low
EPSS
Percentile
51.4%