CVE-2023-6544
Severity:
MEDIUM
Type:
Unavailable / Other
Publication date:
25/04/2024
Last modified:
25/04/2024
Description
A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.
Impact
Base Score 3.x
5.40
Severity 3.x
MEDIUM
References to Advisories, Solutions, and Tools
- https://access.redhat.com/errata/RHSA-2024:1860
- https://access.redhat.com/errata/RHSA-2024:1861
- https://access.redhat.com/errata/RHSA-2024:1862
- https://access.redhat.com/errata/RHSA-2024:1864
- https://access.redhat.com/errata/RHSA-2024:1866
- https://access.redhat.com/errata/RHSA-2024:1867
- https://access.redhat.com/errata/RHSA-2024:1868
- https://access.redhat.com/security/cve/CVE-2023-6544
- https://bugzilla.redhat.com/show_bug.cgi?id=2253116