Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:46512
HistoryApr 18, 2024 - 10:19 a.m.

Authorization Bypass

2024-04-1810:19:01
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
16
keycloak
authorization bypass
regular expression
dynamic client registration
trusteddomain

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.8

Confidence

Low

EPSS

0

Percentile

13.0%

JSON

keycloak is vulnerable to Authorization Bypass. The vulnerability is due to a hardcoded permissive regular expression which is used to filtering allowed hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.

Related

cve 1
osv 3
nvd 1
redhatcve 1
vulnrichment 1
wolfi 1
cvelist 1
cgr 1
github 1
redhat 7
nessus 3
cve
cve
CVE-2023-6544
2024-04-25 16:15:10
osv
osv
CGA-4h4r-vrhm-r8c8
2024-06-06 12:23:39
CGA-vffr-h5qj-w4q4
2024-06-06 12:29:32
Keycloak Authorization Bypass vulnerability
2024-04-17 17:33:29
nvd
nvd
CVE-2023-6544
2024-04-25 16:15:10
redhatcve
redhatcve
CVE-2023-6544
2024-04-17 13:00:39
vulnrichment
vulnrichment
CVE-2023-6544 Keycloak: authorization bypass
2024-04-25 15:58:47
wolfi
wolfi
CVE-2023-6544 vulnerabilities
2024-09-28 21:12:41
cvelist
cvelist
CVE-2023-6544 Keycloak: authorization bypass
2024-04-25 15:58:47
cgr
cgr
CVE-2023-6544 vulnerabilities
2024-05-19 03:07:16
github
github
Keycloak Authorization Bypass vulnerability
2024-04-17 17:33:29
redhat
redhat
(RHSA-2024:1861) Important: Red Hat Single Sign-On 7.6.8 security update on RHEL 8
2024-04-16 19:48:40
(RHSA-2024:1860) Important: Red Hat Single Sign-On 7.6.8 enhancement and security update on RHEL 7
2024-04-16 19:48:33
(RHSA-2024:1862) Important: Red Hat Single Sign-On 7.6.8 security update on RHEL 9
2024-04-16 19:48:44
nessus
nessus
RHEL 9 : Red Hat Single Sign-On 7.6.8 security update on RHEL 9 (Important) (RHSA-2024:1862)
2024-04-17 00:00:00
RHEL 8 : Red Hat Single Sign-On 7.6.8 security update on RHEL 8 (Important) (RHSA-2024:1861)
2024-04-17 00:00:00
RHEL 7 : Red Hat Single Sign-On 7.6.8 and security update on RHEL 7 (Important) (RHSA-2024:1860)
2024-04-17 00:00:00

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

5.8

Confidence

Low

EPSS

0

Percentile

13.0%

JSON
Related for VERACODE:46512
cve1osv3nvd1redhatcve1vulnrichment1wolfi1cvelist1cgr1github1redhat7nessus3