Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-7eps-984r-effr
Summary
Keycloak vulnerable to log Injection during WebAuthn authentication or registration
A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.

Acknowledgements:
Special thanks toTheresa Henze for reporting this issue and helping us improve our security.
Aliases
0
alias CVE-2023-6484
1
alias GHSA-j628-q885-8gr5
Fixed_packages
0
url pkg:maven/org.keycloak/keycloak-services@22.0.9
purl pkg:maven/org.keycloak/keycloak-services@22.0.9
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@22.0.9
1
url pkg:maven/org.keycloak/keycloak-services@23.0.5
purl pkg:maven/org.keycloak/keycloak-services@23.0.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@23.0.5
Affected_packages
0
url pkg:maven/org.keycloak/keycloak-services@23.0.0
purl pkg:maven/org.keycloak/keycloak-services@23.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1qmd-pmw8-g7fu
1
vulnerability VCID-1vt4-atrk-7qet
2
vulnerability VCID-2pkm-5t3t-rygs
3
vulnerability VCID-3ese-6dfu-1bhe
4
vulnerability VCID-3rdf-9pec-vua3
5
vulnerability VCID-3xad-4hy6-dkcf
6
vulnerability VCID-4x3a-6k9m-8qha
7
vulnerability VCID-5w6u-h7mk-6qds
8
vulnerability VCID-7eps-984r-effr
9
vulnerability VCID-a1pj-tqgz-rkd7
10
vulnerability VCID-sf7t-yy7r-1ugn
11
vulnerability VCID-tbwr-jys1-9ber
12
vulnerability VCID-zs3j-z2ys-kke5
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@23.0.0
References
0
reference_url https://access.redhat.com/errata/RHSA-2024:0798
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0798
1
reference_url https://access.redhat.com/errata/RHSA-2024:0799
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0799
2
reference_url https://access.redhat.com/errata/RHSA-2024:0800
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0800
3
reference_url https://access.redhat.com/errata/RHSA-2024:0801
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0801
4
reference_url https://access.redhat.com/errata/RHSA-2024:0804
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0804
5
reference_url https://access.redhat.com/errata/RHSA-2024:1860
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1860
6
reference_url https://access.redhat.com/errata/RHSA-2024:1861
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1861
7
reference_url https://access.redhat.com/errata/RHSA-2024:1862
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1862
8
reference_url https://access.redhat.com/errata/RHSA-2024:1864
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1864
9
reference_url https://access.redhat.com/errata/RHSA-2024:1865
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1865
10
reference_url https://access.redhat.com/errata/RHSA-2024:1866
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1866
11
reference_url https://access.redhat.com/errata/RHSA-2024:1867
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1867
12
reference_url https://access.redhat.com/errata/RHSA-2024:1868
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:1868
13
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-6484
reference_id
reference_type
scores
0
value 0.00596
scoring_system epss
scoring_elements 0.697
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-6484
14
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2248423
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2248423
15
reference_url https://github.com/keycloak/keycloak
reference_id
reference_type
scores
url https://github.com/keycloak/keycloak
16
reference_url https://github.com/keycloak/keycloak/commit/110f64a8146d0817252f90cf4b5e6a62aa897aff
reference_id
reference_type
scores
url https://github.com/keycloak/keycloak/commit/110f64a8146d0817252f90cf4b5e6a62aa897aff
17
reference_url https://github.com/keycloak/keycloak/commit/f9049565a9a228faa08138b9269d66d3de6c7e9a
reference_id
reference_type
scores
url https://github.com/keycloak/keycloak/commit/f9049565a9a228faa08138b9269d66d3de6c7e9a
18
reference_url https://github.com/keycloak/keycloak/issues/25078
reference_id
reference_type
scores
url https://github.com/keycloak/keycloak/issues/25078
19
reference_url https://access.redhat.com/security/cve/CVE-2023-6484
reference_id CVE-2023-6484
reference_type
scores
url https://access.redhat.com/security/cve/CVE-2023-6484
20
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-6484
reference_id CVE-2023-6484
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-6484
21
reference_url https://github.com/advisories/GHSA-j628-q885-8gr5
reference_id GHSA-j628-q885-8gr5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j628-q885-8gr5
22
reference_url https://github.com/keycloak/keycloak/security/advisories/GHSA-j628-q885-8gr5
reference_id GHSA-j628-q885-8gr5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/keycloak/keycloak/security/advisories/GHSA-j628-q885-8gr5
Weaknesses
0
cwe_id 117
name Improper Output Neutralization for Logs
description The product does not neutralize or incorrectly neutralizes output that is written to logs.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 6.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-7eps-984r-effr