VYPR
← All advisories
Medium severity4.6NVD Advisory· Published Dec 14, 2023· Updated Jun 17, 2026

CVE-2023-6134

CVE-2023-6134

Description

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-servicesMaven
< 23.0.323.0.3

Affected products

18
  • Red Hat/Red Hat build of Keycloak 22.0.7v5
    cpe:/a:redhat:build_keycloak:22
  • Red Hat/Build Of Keycloakcpe-rescue
    cpe:/a:redhat:build_keycloak:22::el9
    Range: 22-9
  • Red Hat/Single Sign Oncpe-rescue7 versions
    cpe:/a:redhat:red_hat_single_sign_on:7.6+ 6 more
    • cpe:/a:redhat:red_hat_single_sign_on:7.6
    • cpe:/a:redhat:red_hat_single_sign_on:7.6.6
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el7range: 0:18.0.12-1.redhat_00001.1.el7sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el8range: 0:18.0.12-1.redhat_00001.1.el8sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el9range: 0:18.0.12-1.redhat_00001.1.el9sso
    • cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*range: <7.6
    • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
  • Red Hat/RHEL-8 based Middleware Containersv5
    cpe:/a:redhat:rhosemc:1.0::el8
    Range: 7.6-41
  • Red Hat/Keycloak
    cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
    Range: <22.0.7
  • Red Hat/Openshift Container Platform4 versions
    cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform Ibm Z Systems2 versions
    cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-services
    Range: < 23.0.3

Patches

Vulnerability mechanics

References

18

News mentions

0

No linked articles in our index yet.