CVE-2024-1132
17.04.2024, 14:15
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
| Vendor | Product | Version |
|---|---|---|
| redhat | build_of_keycloak | - |
| redhat | jboss_middleware_text-only_advisories | 1.0 |
| redhat | keycloak | 21.1.0 ≤ 𝑥 < 22.0.10 |
| redhat | keycloak | 23.0.0 ≤ 𝑥 < 24.0.3 |
| redhat | migration_toolkit_for_applications | 1.0 |
| redhat | migration_toolkit_for_runtimes | - |
| redhat | openshift_container_platform | 4.11 |
| redhat | openshift_container_platform | 4.12 |
| redhat | openshift_container_platform_for_ibm_z | 4.9 |
| redhat | openshift_container_platform_for_ibm_z | 4.10 |
| redhat | openshift_container_platform_for_linuxone | 4.9 |
| redhat | openshift_container_platform_for_linuxone | 4.10 |
| redhat | openshift_container_platform_for_power | 4.9 |
| redhat | openshift_container_platform_for_power | 4.10 |
| redhat | single_sign-on | - |
| redhat | single_sign-on | 7.6 |
𝑥
= Vulnerable software versions
References