CVE-2023-6717

Published: Apr 25, 2024

Modified: Jun 2, 2026

PUBLISHED

CVSS v3.1

6.0

MEDIUM

Description

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

Vendor	Product	Versions
Unknown	keycloak	affected `0 - < 22.0.10` affected `24.0.0 - < 24.0.3`
Red Hat	Red Hat AMQ Broker 7	All versions
Red Hat	Red Hat build of Keycloak 22	unaffected `22.0.10-1 - < *`
Red Hat	Red Hat build of Keycloak 22	unaffected `22-13 - < *`
Red Hat	Red Hat build of Keycloak 22	unaffected `22-16 - < *`
Red Hat	Red Hat build of Keycloak 22.0.10	All versions
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-3 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHOSS-1.33-RHEL-8	unaffected `1.33.0-5 - < *`
Red Hat	RHPAM 7.13.5 async	All versions
Red Hat	Migration Toolkit for Applications 6	All versions
Red Hat	Migration Toolkit for Applications 7	All versions
Red Hat	Red Hat build of Apicurio Registry 2	All versions
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Decision Manager 7	All versions
Red Hat	Red Hat Developer Hub	All versions
Red Hat	Red Hat Fuse 7	All versions
Red Hat	Red Hat JBoss Data Grid 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 6	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 6	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 6	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat OpenShift GitOps	All versions
Red Hat	Red Hat Process Automation 7	All versions
Red Hat	Red Hat Single Sign-On 7	All versions