CVE-2023-2585

creationtimestamp| type| source ---|---|--- 2023-12-21 11:22:18+00:00| seen| https://t.me/ctinow/157610 2023-12-23 04:24:51+00:00| seen| https://t.me/arpsyndicate/2079...

CVE-2023-2585

CVE-2023-2585 concerns Keycloak’s Device Authorization Grant, where flawed validation of device_code and client_id could allow a malicious OAuth client to spoof a consent request and trick an admin into granting access to other OAuth clients or cause unauthorized access. Connected sources corrobo...

com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17), com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=21.0.0) +113 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=21.1.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.2, =1.2, =0.0.1, =1.0.7 and more Source cves: CVE-2023-2585 Source advisory: MEND:CVE-2023-2585...

de.adorsys.keycloak:user-secret-adapter-embedded (1.0.7), de.adorsys.keycloak:user-secret-auth-provider (1.0.7) +12 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (7.0.0)

org.keycloak:keycloak-services MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:user-secret-adapter-embedded 1.0.7 -...

org.keycloak:keycloak-account-freemarker (1.8.0.final), org.keycloak:keycloak-broker-oidc (1.8.0.final) +9 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (1.8.0.final)

org.keycloak:keycloak-services MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.final - org.keycloak:keycloak-broker-oidc...

com.github.vzakharchenko:keycloak-plugins (1.2.4), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.4) +19 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (10.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.4 -...

org.keycloak:keycloak-account-freemarker (1.4.0.final), org.keycloak:keycloak-broker-oidc (1.4.0.final) +8 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (1.4.0.final)

org.keycloak:keycloak-services MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.4.0.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-authz-policy-common (4.7.0.final), org.keycloak:keycloak-dependencies-server-min (4.7.0.final) +9 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (4.7.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 4.7.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.7.final), org.keycloak:keycloak-dependencies-server-min (1.9.7.final) +2 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (1.9.7.final)

org.keycloak:keycloak-services MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.7.final -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

org.keycloak:keycloak-authz-policy-common (3.4.1.cr1), org.keycloak:keycloak-authz-policy-drools (3.4.1.cr1) +13 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (3.4.1.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 3.4.1.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.4.1.cr1 -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), org.keycloak:keycloak-dependencies-server-min (4.5.0.final) +3 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (4.5.0.final)

org.keycloak:keycloak-services MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final -...

org.keycloak:keycloak-account-freemarker (1.3.0.final), org.keycloak:keycloak-broker-oidc (1.3.0.final) +10 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (1.3.0.final)

org.keycloak:keycloak-services MAVEN version 1.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.3.0.final - org.keycloak:keycloak-broker-oidc...

com.github.vzakharchenko:chillispot-radius-plugin (1.2.6), com.github.vzakharchenko:cisco-radius-plugin (1.2.6) +18 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (11.0.0)

org.keycloak:keycloak-services MAVEN version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.2.6 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.12, <=1.3.14), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.12, <=1.3.14) +29 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (15.0.2)

org.keycloak:keycloak-services MAVEN version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.12, =1.3.12, =1.3.12, =1.3.12, =1.3.12,...

org.keycloak:keycloak-authz-policy-drools (2.2.1.final), org.keycloak:keycloak-dependencies-server-all (2.2.1.final) +4 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (2.2.1.final)

org.keycloak:keycloak-services MAVEN version 2.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.2.1.final -...

com.github.vzakharchenko:keycloak-plugins (1.0.2), com.github.vzakharchenko:mikrotik-radius-plugin (1.0.2) +20 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (8.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.0.2 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-common (3.1.0.final) +12 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (3.1.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +30 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (19.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0....

org.keycloak:keycloak-authz-policy-common (11.0.1), org.keycloak:keycloak-dependencies-server-all (11.0.1) +13 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (11.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 11.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 11.0.1 -...