CVE-2023-6291

Katalog CVE

CVSS 7.1 · High EPSS 0,95%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada redhat keycloak, redhat single sign-on +5 lainnya. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Rincian

Terbit di NVD

26 Januari 2024

Terakhir diubah

22 September 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2023:7854 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7855 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7856 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7857 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7858 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7860 advisory vendor
• https://access.redhat.com/errata/RHSA-2023:7861 advisory vendor
• https://access.redhat.com/security/cve/CVE-2023-6291 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2251407 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2024:0798
• https://access.redhat.com/errata/RHSA-2024:0799
• https://access.redhat.com/errata/RHSA-2024:0800
• https://access.redhat.com/errata/RHSA-2024:0801
• https://access.redhat.com/errata/RHSA-2024:0804