Search for vulnerabilities
Vulnerability details: VCID-4kz1-zbkx-aaaq
Vulnerability ID VCID-4kz1-zbkx-aaaq
Aliases CVE-2023-6134
GHSA-cvg2-7c3j-g36j
Summary keycloak: reflected XSS via wildcard in OIDC redirect_uri
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2023:7854
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7854
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2023:7855
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7855
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2023:7856
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7856
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2023:7857
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7857
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2023:7858
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7858
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7860
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7860
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7861
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7861
cvssv3.1 5.3 https://access.redhat.com/errata/RHSA-2024:0798
ssvc Track https://access.redhat.com/errata/RHSA-2024:0798
cvssv3.1 5.3 https://access.redhat.com/errata/RHSA-2024:0799
ssvc Track https://access.redhat.com/errata/RHSA-2024:0799
cvssv3.1 5.3 https://access.redhat.com/errata/RHSA-2024:0800
ssvc Track https://access.redhat.com/errata/RHSA-2024:0800
cvssv3.1 5.3 https://access.redhat.com/errata/RHSA-2024:0801
ssvc Track https://access.redhat.com/errata/RHSA-2024:0801
cvssv3.1 5.3 https://access.redhat.com/errata/RHSA-2024:0804
ssvc Track https://access.redhat.com/errata/RHSA-2024:0804
cvssv3 4.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6134.json
cvssv3.1 4.6 https://access.redhat.com/security/cve/CVE-2023-6134
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2023-6134
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00150 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00150 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.00818 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01109 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01267 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.01836 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
epss 0.02216 https://api.first.org/data/v1/epss?cve=CVE-2023-6134
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-cvg2-7c3j-g36j
cvssv3.1 6.8 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 4.6 https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20
cvssv3.1_qr MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-cvg2-7c3j-g36j
cvssv3 5.4 https://nvd.nist.gov/vuln/detail/CVE-2023-6134
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2023-6134
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2023:7854
https://access.redhat.com/errata/RHSA-2023:7855
https://access.redhat.com/errata/RHSA-2023:7856
https://access.redhat.com/errata/RHSA-2023:7857
https://access.redhat.com/errata/RHSA-2023:7858
https://access.redhat.com/errata/RHSA-2023:7860
https://access.redhat.com/errata/RHSA-2023:7861
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6134.json
https://access.redhat.com/security/cve/CVE-2023-6134
https://api.first.org/data/v1/epss?cve=CVE-2023-6134
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20
2249673 https://bugzilla.redhat.com/show_bug.cgi?id=2249673
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
CVE-2023-6134 https://nvd.nist.gov/vuln/detail/CVE-2023-6134
GHSA-cvg2-7c3j-g36j https://github.com/advisories/GHSA-cvg2-7c3j-g36j
GHSA-cvg2-7c3j-g36j https://github.com/keycloak/keycloak/security/advisories/GHSA-cvg2-7c3j-g36j
RHSA-2024:0798 https://access.redhat.com/errata/RHSA-2024:0798
RHSA-2024:0799 https://access.redhat.com/errata/RHSA-2024:0799
RHSA-2024:0800 https://access.redhat.com/errata/RHSA-2024:0800
RHSA-2024:0801 https://access.redhat.com/errata/RHSA-2024:0801
RHSA-2024:0804 https://access.redhat.com/errata/RHSA-2024:0804
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:7854
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:7855
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:7856
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:7857
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:7858
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7860
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:0798
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-12T14:33:06Z/ Found at https://access.redhat.com/errata/RHSA-2024:0798
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:0799
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-12T14:33:06Z/ Found at https://access.redhat.com/errata/RHSA-2024:0799
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:0800
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-12T14:33:06Z/ Found at https://access.redhat.com/errata/RHSA-2024:0800
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:0801
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-12T14:33:06Z/ Found at https://access.redhat.com/errata/RHSA-2024:0801
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:0804
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-12T14:33:06Z/ Found at https://access.redhat.com/errata/RHSA-2024:0804
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6134.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2023-6134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-6134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-6134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.46014
EPSS Score 0.00114
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.