Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-J628-Q885-8GR5
HistoryApr 17, 2024 - 6:24 p.m.

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

2024-04-1718:24:03
CWE-117
GitHub Advisory Database
github.com
2
keycloak
log injection
webauthn
authentication
security
issue

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

16.2%

JSON

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with “Security Key login” (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.

Acknowledgements:
Special thanks toTheresa Henze for reporting this issue and helping us improve our security.

Related

cve 1
veracode 1
osv 1
redhatcve 1
cvelist 1
nessus 6
redhat 13
cve
cve
CVE-2023-6484
2024-04-25 15:58:18
veracode
veracode
Improper Logs Output Neutralization
2024-04-18 07:00:37
osv
osv
Keycloak vulnerable to log Injection during WebAuthn authentication or registration
2024-04-17 18:24:03
redhatcve
redhatcve
CVE-2023-6484
2023-12-04 10:56:49
cvelist
cvelist
Keycloak: log injection during webauthn authentication or registration
2024-04-25 15:58:18
nessus
nessus
RHEL 7 : Red Hat Single Sign-On 7.6.8 and security update on RHEL 7 (Important) (RHSA-2024:1860)
2024-04-17 00:00:00
RHEL 8 : Red Hat Single Sign-On 7.6.8 security update on RHEL 8 (Important) (RHSA-2024:1861)
2024-04-17 00:00:00
RHEL 9 : Red Hat Single Sign-On 7.6.8 security update on RHEL 9 (Important) (RHSA-2024:1862)
2024-04-17 00:00:00
redhat
redhat
(RHSA-2024:1862) Important: Red Hat Single Sign-On 7.6.8 security update on RHEL 9
2024-04-16 19:48:44
(RHSA-2024:1865) Low: Red Hat Single Sign-On 7.6.8 Operator enhancement and security update
2024-04-16 19:49:38
(RHSA-2024:1866) Important: Red Hat Single Sign-On 7.6.8 security update
2024-04-16 20:02:21

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

16.2%

JSON
Related for GHSA-J628-Q885-8GR5
cve1veracode1osv1redhatcve1cvelist1nessus6redhat13