CVE-2023-6134

MEDIUM4.6EPSS 2.5%

Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

發布日:2023/12/18修改日:2024/2/16

描述

Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

參考連結(13)