CVE-2024-8883 Keycloak: vulnerable redirect uri validation results in open redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Problem types: cwe_id: CWE-601
description: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:22
default_status: unaffected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:24
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 24
cpes: cpe:/a:redhat:build_keycloak:24::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 24
cpes: cpe:/a:redhat:build_keycloak:24::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 24
cpes: cpe:/a:redhat:build_keycloak:24::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Karsten Meyer zu Selhausen and Niklas Conrad for reporting this issue.
Published: 2024-09-19T15:48:28.468Z