Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Keycloak: vulnerable redirect uri validation results in open redirec (keycloak-services)

CVE-2024-8883
MEDIUM 6.1

At a glance

Source
NVD
EPSS
EPSS 2.11 % · percentile 82 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Modified

Search on…

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Weaknesses (CWE)

  • CWE-601 — URL Redirection to Untrusted Site

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nredhat
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · secalert@redhat.com (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · nvd@nist.gov (Secondary)

Advisories

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
keycloak-servicesaffected 0 < 22.0.12 ; affected 23.0.0 < 24.0.7 ; affected 25.0.0 < 25.0.5
Red Hat · Red Hat Build of Keycloak
Red Hat · Red Hat Build of Keycloak
Red Hat · Red Hat build of Keycloak 22unaffected 22.0.13-1 < *
Red Hat · Red Hat build of Keycloak 22unaffected 22-18 < *
Red Hat · Red Hat build of Keycloak 22unaffected 22-21 < *
Red Hat · Red Hat build of Keycloak 24unaffected 24.0.8-1 < *
Red Hat · Red Hat build of Keycloak 24unaffected 24-17 < *
Red Hat · Red Hat build of Keycloak 24unaffected 24-17 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8
Red Hat · Red Hat JBoss Enterprise Application Platform 8
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:800.4.1-1.GA_redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:8.0.4-3.GA_redhat_00007.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:2.33.0-1.redhat_00015.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 1:2.0.0-2.redhat_00005.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:1.8.0-2.redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:2.2.0-2.redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:1.16.1-2.redhat_00007.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:3.2.2-28.redhat_2.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:2.15.1-1.redhat_00001.1.el8eap < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD