CVE-2023-6717 Keycloak: xss via assertion consumer service url in saml post-binding flow
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat AMQ Broker 7
cpes: cpe:/a:redhat:amq_broker:7.12
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22.0.10
cpes: cpe:/a:redhat:build_keycloak:22
default_status: unaffected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHPAM 7.13.5 async
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
default_status: unaffected
vendor: Red Hat
product: Migration Toolkit for Applications 6
cpes: cpe:/a:redhat:migration_toolkit_applications:6
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Applications 7
cpes: cpe:/a:redhat:migration_toolkit_applications:7
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apicurio Registry 2
cpes: cpe:/a:redhat:service_registry:2
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus
cpes: cpe:/a:redhat:quarkus:2
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Quarkus
cpes: cpe:/a:redhat:quarkus:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat Decision Manager 7
cpes: cpe:/a:redhat:jboss_enterprise_brms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Developer Hub
cpes: cpe:/a:redhat:rhdh:1
default_status: unaffected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift GitOps
cpes: cpe:/a:redhat:openshift_gitops:1
default_status: affected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-04-25T16:02:03.267Z