CVE-2023-6134
Dashboard / Vulnerabilities / CVE-2023-6134
Summary: Keycloak: reflected xss via wildcard in oidc redirect_uri
Details: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
References: https://access.redhat.com/downloads/content/package-browser/, https://access.redhat.com/jbossnetwork/restricted/listSoftware.html, https://catalog.redhat.com/software/containers/, https://access.redhat.com/errata/RHSA-2023:7854, https://access.redhat.com/errata/RHSA-2023:7855, https://access.redhat.com/errata/RHSA-2023:7856, https://access.redhat.com/errata/RHSA-2023:7857, https://access.redhat.com/errata/RHSA-2023:7858, https://access.redhat.com/errata/RHSA-2023:7860, https://access.redhat.com/errata/RHSA-2023:7861, https://access.redhat.com/errata/RHSA-2024:0798, https://access.redhat.com/errata/RHSA-2024:0799, https://access.redhat.com/errata/RHSA-2024:0800, https://access.redhat.com/errata/RHSA-2024:0801, https://access.redhat.com/errata/RHSA-2024:0804, https://access.redhat.com/security/cve/CVE-2023-6134, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6134.json, https://nvd.nist.gov/vuln/detail/CVE-2023-6134, https://bugzilla.redhat.com/show_bug.cgi?id=2249673
Affected packages
Package
Name:
Purl:
