Riskcovery

CVE-2023-6717

Keycloak: xss via assertion consumer service url in saml post-binding flow

State
Published
Severity
6.0 Medium
Published
Apr 25, 2024
Updated
Oct 27, 2026
Reserved
Dec 12, 2023

Read the record on cve.org

Description

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

Scores

CVSSScoreVectorSource
3.16.0 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:Lredhat

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
keycloak
  • before 22.0.10Affected
  • 24.0.0 to before 24.0.3Affected
Red Hat AMQ Broker 7Red Hat
    Red Hat build of Keycloak 22Red Hat
    • 22.0.10-1 and laterNot affected
    Red Hat build of Keycloak 22Red Hat
    • 22-13 and laterNot affected
    Red Hat build of Keycloak 22Red Hat
    • 22-16 and laterNot affected
    Red Hat build of Keycloak 22.0.10Red Hat
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-3 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHOSS-1.33-RHEL-8Red Hat
      • 1.33.0-5 and laterNot affected
      RHPAM 7.13.5 asyncRed Hat
        Migration Toolkit for Applications 6Red Hat
          Migration Toolkit for Applications 7Red Hat
            Red Hat build of Apicurio Registry 2Red Hat
              Red Hat build of QuarkusRed Hat
                Red Hat build of QuarkusRed Hat
                  Red Hat Data Grid 8Red Hat
                    Red Hat Decision Manager 7Red Hat
                      Red Hat Developer Hub 1Red Hat
                        Red Hat Fuse 7Red Hat
                          Red Hat JBoss Data Grid 7Red Hat
                            Red Hat JBoss Enterprise Application Platform 6Red Hat
                              Red Hat JBoss Enterprise Application Platform 6Red Hat
                                Red Hat JBoss Enterprise Application Platform 6Red Hat
                                  Red Hat JBoss Enterprise Application Platform 7Red Hat
                                    Red Hat JBoss Enterprise Application Platform 8Red Hat
                                      Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat
                                        Red Hat OpenShift GitOpsRed Hat
                                          Red Hat Process Automation 7Red Hat
                                            Red Hat Single Sign-On 7Red Hat

                                              References

                                              Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.