Red Hat Build Of Keycloak 22.0.10 vulnerabilities

6 CVEs affecting Red Hat Build Of Keycloak 22.0.10, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0657, published 2024-11-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-6544, published 2024-04-25. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with…
CVE-2023-6484, published 2024-04-25. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs…
CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2023-3597, published 2024-04-25. Medium severity, CVSS 5.0. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to…
CVE-2024-1249, published 2024-04-17. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in…
CVE-2023-0657, published 2024-11-17. Low severity, CVSS 3.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for…