Medium [CVE-2020-10748 +1] Keycloak: reflected xss via wildcard in oidc redirect_uri
This medium-severity Red Hat Linux advisory covers CVE-2023-6134 and CVE-2020-10748 affecting Red Hat build of Keycloak 22.0.7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 2 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks.
This flaw is the result of an incomplete fix for CVE-2020-10748. Red Hat severity: Moderate — CVSS 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
Weakness: CWE-79. Affected Red Hat products: Red Hat build of Keycloak 22; Red Hat build of Keycloak 22.0.7; Red Hat Single Sign-On 7; Red Hat Single Sign-On 7.6 for RHEL 7; Red Hat Single Sign-On 7.6 for RHEL 8; Red Hat Single Sign-On 7.6 for RHEL 9; RHEL-8 based Middleware Containers; Single Sign-On 7.6.6.
Red Hat fixing advisory: RHSA-2023:7861, RHSA-2023:7860, RHSA-2024:0804, RHSA-2023:7854, RHSA-2024:0798, RHSA-2023:7856, RHSA-2024:0799, RHSA-2023:7855, RHSA-2024:0800, RHSA-2023:7857, RHSA-2024:0801, RHSA-2023:7858.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
- rhbk/keycloak-operator-bundle:22.0.7-1
- rhbk/keycloak-rhel9:22-6
- rhbk/keycloak-rhel9-operator:22-9
- rh-sso7-keycloak
- rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el7sso
- rh-sso7-keycloak-0:18.0.12-1.redhat_00001.1.el7sso
- rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el8sso
- rh-sso7-keycloak-0:18.0.12-1.redhat_00001.1.el8sso
- rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el9sso
- rh-sso7-keycloak-0:18.0.12-1.redhat_00001.1.el9sso
- rh-sso-7/sso76-openshift-rhel8:7.6-38
- rh-sso-7/sso7-rhel8-operator-bundle:7.6.6-2
- rh-sso-7/sso76-openshift-rhel8:7.6-41
- RHSA-2023:7861
- RHSA-2023:7860
- RHSA-2024:0804
- RHSA-2023:7854
- RHSA-2024:0798
- RHSA-2023:7856
- RHSA-2024:0799
- RHSA-2023:7855
- RHSA-2024:0800
- RHSA-2023:7857
- RHSA-2024:0801
- RHSA-2023:7858
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Mitigation
Upgrade to a fixed release: rhbk/keycloak-operator-bundle:22.0.7-1, rhbk/keycloak-rhel9:22-6, rhbk/keycloak-rhel9-operator:22-9, rh-sso7-keycloak, rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el7sso, rh-sso7-keycloak-0:18.0.12-1.redhat_00001.1.el7sso. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.