← Back to CVEs

CVE-2024-8883

MEDIUM

6.1

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

CVE Details

CVSS v3.1 Score6.1

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published9/19/2024

Last Modified11/26/2024

Sourcenvd

Honeypot Sightings0

Affected Products

redhat:build_of_keycloakredhat:openshift_container_platformredhat:openshift_container_platform_for_ibm_zredhat:openshift_container_platform_for_linuxoneredhat:openshift_container_platform_for_powerredhat:single_sign-on

Weaknesses (CWE)

CWE-601

References

https://access.redhat.com/errata/RHSA-2024:10385(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:10386(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6878(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6879(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6880(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6882(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6886(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6887(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6888(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6889(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6890(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8823(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8824(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8826(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2024-8883(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2312511(secalert@redhat.com)

https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java(secalert@redhat.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.