← Retour aux CVEs

CVE-2024-8883

MEDIUM

6.1

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Details CVE

Score CVSS v3.16.1

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie9/19/2024

Derniere modification11/26/2024

Sourcenvd

Observations honeypot0

Produits affectes

redhat:build_of_keycloakredhat:openshift_container_platformredhat:openshift_container_platform_for_ibm_zredhat:openshift_container_platform_for_linuxoneredhat:openshift_container_platform_for_powerredhat:single_sign-on

Faiblesses (CWE)

CWE-601

References

https://access.redhat.com/errata/RHSA-2024:10385(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:10386(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6878(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6879(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6880(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6882(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6886(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6887(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6888(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6889(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:6890(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8823(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8824(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8826(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2024-8883(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2312511(secalert@redhat.com)

https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java(secalert@redhat.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.