CVE-2023-6544 — Keycloak: authorization bypass

Description (CNA)

A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 22.0.0 before 22.0.10; affected 23.0.0 before 24.0.3
Red Hat / Red Hat build of Keycloak 22	unaffected 22.0.10-1 before *
Red Hat / Red Hat build of Keycloak 22	unaffected 22-13 before *
Red Hat / Red Hat build of Keycloak 22	unaffected 22-16 before *
Red Hat / Red Hat build of Keycloak 22.0.10	unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7	unaffected 0:18.0.13-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8	unaffected 0:18.0.13-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9	unaffected 0:18.0.13-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containers	unaffected 7.6-46 before *
Red Hat / RHSSO 7.6.8	unaffected

CWE

CWE-625

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.