Red Hat Rhsso 7.6.8 vulnerabilities

4 CVEs affecting Red Hat Rhsso 7.6.8, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6544, published 2024-04-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-6544, published 2024-04-25. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with…
CVE-2023-6484, published 2024-04-25. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs…
CVE-2023-3597, published 2024-04-25. Medium severity, CVSS 5.0. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to…
CVE-2024-1249, published 2024-04-17. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in…