CVE-2023-6484mediumCWE-117

Keycloak: log injection during webauthn authentication or registration

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.0%

exploitation probability

1.0%top 39% of all CVEs

observed exploitation

nono source reports it

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

keycloakRed Hat · Red Hat build of Keycloak 22 Red Hat · Red Hat build of Keycloak 22.0.10 Red Hat · Red Hat Single Sign-On 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9 Red Hat · RHEL-8 based Middleware Containers Red Hat · RHSSO 7.6.8

References