Keycloak vulnerable to log Injection during WebAuthn authentication or registration
A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-6484US | — | — | ||
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor i… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2024:0798WEB
- https://access.redhat.com/errata/RHSA-2024:0799WEB
- https://access.redhat.com/errata/RHSA-2024:0800WEB
- https://access.redhat.com/errata/RHSA-2024:0801WEB
- https://access.redhat.com/errata/RHSA-2024:0804WEB
- https://access.redhat.com/errata/RHSA-2024:1860WEB
- https://access.redhat.com/errata/RHSA-2024:1861WEB
- https://access.redhat.com/errata/RHSA-2024:1862WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan