Red Hat Rhoss-1.33-Rhel-8 vulnerabilities

3 CVEs affecting Red Hat Rhoss-1.33-Rhel-8, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6717, published 2024-04-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2024-1249, published 2024-04-17. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in…
CVE-2024-2700, published 2024-04-04. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting…