CVE-2023-6484mediumCWE-117

Keycloak: log injection during webauthn authentication or registration

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 1.0%

probabilidade de exploração

1.0%top 41% das CVEs

exploração observada

nãonenhuma fonte reporta

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

keycloakRed Hat · Red Hat build of Keycloak 22 Red Hat · Red Hat build of Keycloak 22.0.10 Red Hat · Red Hat Single Sign-On 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9 Red Hat · RHEL-8 based Middleware Containers Red Hat · RHSSO 7.6.8

Referências