Red Hat Keycloak CVE-2024-8883 Open Redirect Vulnerability Advisory

Key Information 1. Vulnerability Description: - Name: CVE-2024-8883 - Disclosure Date: September 19, 2024 - Severity: Medium - Issue: A misconfiguration in Keycloak allows attackers to redirect users to arbitrary URLs. If a valid redirect URI is set to or , this could lead to exposure of sensitive information such as authorization codes to attackers, potentially resulting in session hijacking. 2. Affected Component: - Component: org.keycloak/keycloak-services - Status: Affected 3. Affected Packages and Red Hat Security Fixes: - Packages: Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 - Status: Affected 4. CVSS v3 Score: - Score: 6.8 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Impact Factors: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Impact: High 5. Acknowledgments: - Red Hat thanks Karsten Meyer zu Selhausen and Niklas Conrad for reporting this issue. 6. Frequently Asked Questions: - Why does Red Hat’s CVSS v3 score or impact differ from other vendors? - If my product is listed as “Under Investigation” or “Affected,” when will Red Hat release a fix for this vulnerability? - If my product is listed as “Unfixable,” what should I do? - If my product is listed as “Fix Deferred,” what should I do? - What are mitigations? - I have a Red Hat product, but it’s not listed above—am I affected? - Why does my security scanner report that my product is affected by this vulnerability, even though my product version is patched or not affected? Summary This vulnerability is a misconfiguration in Keycloak that allows attackers to redirect users to arbitrary URLs, potentially leading to exposure of sensitive information and session hijacking. Affected components and packages include Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, and Red Hat Single Sign-On 7. The CVSS v3 score indicates a medium-risk vulnerability, with impact factors including network attack vector, high attack complexity, and high impact.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Keycloak CVE-2024-8883 Open Redirect Vulnerability Advisory

More from this source