CVE-2023-2585

Katalog CVE

CVSS 8.1 · High EPSS 0,69%

Kerentanan Improperly Implemented Security Check for Standard pada redhat single sign-on, redhat openshift container platform +3 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.

Rincian

Terbit di NVD

21 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-358: Improperly Implemented Security Check for Standard

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:3883 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:3884 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:3885 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:3888 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:3892 advisory vendor
• https://access.redhat.com/security/cve/CVE-2023-2585 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2196335 issue tracking · advisory vendor