CVE-2024-8883
MEDIUM severity · CVSS 6.1 · CWE-601
6.1CVSS MEDIUM
Summary
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactLow
Integrity impactLow
Availability impactNone
Exploit probability (EPSS)2%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://access.redhat.com/errata/RHSA-2024:6878Advisory
- https://access.redhat.com/errata/RHSA-2024:6879Advisory
- https://access.redhat.com/errata/RHSA-2024:6880Advisory
- https://access.redhat.com/errata/RHSA-2024:6882Advisory
- https://access.redhat.com/errata/RHSA-2024:6886Advisory
- https://access.redhat.com/errata/RHSA-2024:6887Advisory
- https://access.redhat.com/errata/RHSA-2024:10385
- https://access.redhat.com/errata/RHSA-2024:10386