Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-J628-Q885-8GR5
HistoryApr 17, 2024 - 6:24 p.m.

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

2024-04-1718:24:03
CWE-117
GitHub Advisory Database
github.com
9
keycloak
log injection
webauthn
authentication
security
issue

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

17.1%

JSON

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with “Security Key login” (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.

Acknowledgements:
Special thanks toTheresa Henze for reporting this issue and helping us improve our security.

Affected configurations

Vulners
Node
org.keycloak\keycloakMatchservices
OR
org.keycloak\keycloakMatchservices
VendorProductVersionCPE
org.keycloak\keycloakservicescpe:2.3:a:org.keycloak\:keycloak:services:*:*:*:*:*:*:*:*

References

Related

vulnrichment 1
nvd 1
cve 1
veracode 1
osv 1
cvelist 1
redhatcve 1
nessus 6
redhat 13
vulnrichment
vulnrichment
CVE-2023-6484 Keycloak: log injection during webauthn authentication or registration
2024-04-25 15:58:18
nvd
nvd
CVE-2023-6484
2024-04-25 16:15:09
cve
cve
CVE-2023-6484
2024-04-25 16:15:09
veracode
veracode
Improper Logs Output Neutralization
2024-04-18 07:00:37
osv
osv
Keycloak vulnerable to log Injection during WebAuthn authentication or registration
2024-04-17 18:24:03
cvelist
cvelist
CVE-2023-6484 Keycloak: log injection during webauthn authentication or registration
2024-04-25 15:58:18
redhatcve
redhatcve
CVE-2023-6484
2023-12-04 10:56:49
nessus
nessus
RHEL 7 : Red Hat Single Sign-On 7.6.8 and security update on RHEL 7 (Important) (RHSA-2024:1860)
2024-04-17 00:00:00
RHEL 8 : Red Hat Single Sign-On 7.6.8 security update on RHEL 8 (Important) (RHSA-2024:1861)
2024-04-17 00:00:00
RHEL 9 : Red Hat Single Sign-On 7.6.8 security update on RHEL 9 (Important) (RHSA-2024:1862)
2024-04-17 00:00:00
redhat
redhat
(RHSA-2024:1862) Important: Red Hat Single Sign-On 7.6.8 security update on RHEL 9
2024-04-16 19:48:44
(RHSA-2024:1865) Low: Red Hat Single Sign-On 7.6.8 Operator enhancement and security update
2024-04-16 19:49:38
(RHSA-2024:1861) Important: Red Hat Single Sign-On 7.6.8 security update on RHEL 8
2024-04-16 19:48:40

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

17.1%

JSON
Related for GHSA-J628-Q885-8GR5
vulnrichment1nvd1cve1veracode1osv1cvelist1redhatcve1nessus6redhat13