Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:44789
HistoryDec 22, 2023 - 7:35 a.m.

Open Redirect

2023-12-2207:35:05
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
17
keycloak
vulnerable
open redirect
redirectutils
access token
validation logic

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

51.1%

JSON

Keycloak Services is vulnerable to Open Redirect. The vulnerability is due to the redirect_uri validation logic within RedirectUtils.java. This allows an attacker to steal an access token by bypassing the allowed host validation.

Related

nvd 2
github 1
osv 2
cve 2
prion 1
redhatcve 2
cvelist 2
redhat 12
vulnrichment 1
nessus 6
nvd
nvd
CVE-2023-6291
2024-01-26 15:15:08
CVE-2024-2419
2024-04-17 14:15:08
github
github
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
2023-12-21 18:25:30
osv
osv
CVE-2023-6291
2024-01-26 15:15:08
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
2023-12-21 18:25:30
cve
cve
CVE-2023-6291
2024-01-26 15:15:08
CVE-2024-2419
2024-04-17 14:15:08
prion
prion
Input validation
2024-01-26 15:15:00
redhatcve
redhatcve
CVE-2023-6291
2023-12-14 18:01:10
CVE-2024-2419
2024-04-17 13:02:42
cvelist
cvelist
CVE-2023-6291 Keycloak: redirect_uri validation bypass
2024-01-26 14:23:43
CVE-2024-2419 Keycloak: path traversal in the redirect validation
2024-04-17 13:23:34
redhat
redhat
(RHSA-2023:7861) Important: Red Hat build of Keycloak 22.0.7 images enhancement and security update
2023-12-14 19:13:59
(RHSA-2023:7860) Important: Red Hat build of Keycloak 22.0.7 enhancement and security update
2023-12-14 19:13:55
(RHSA-2023:7858) Important: Red Hat Single Sign-On 7.6.6 security update
2023-12-14 19:02:52
vulnrichment
vulnrichment
CVE-2024-2419 Keycloak: path traversal in the redirect validation
2024-04-17 13:23:34
nessus
nessus
RHEL 9 : Red Hat Single Sign-On 7.6.6 security update on RHEL 9 (Important) (RHSA-2023:7855)
2023-12-15 00:00:00
RHEL 8 : Red Hat Single Sign-On 7.6.6 security update on RHEL 8 (Important) (RHSA-2023:7856)
2023-12-15 00:00:00
RHEL 7 : Red Hat Single Sign-On 7.6.6 security update on RHEL 7 (Important) (RHSA-2023:7854)
2023-12-15 00:00:00

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

51.1%

JSON
Related for VERACODE:44789
nvd2github1osv2cve2prion1redhatcve2cvelist2redhat12vulnrichment1nessus6