XSS in Red Hat Migration Toolkit For Applications 6
CVE-2023-6717
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (49.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L.
Affected products
- Red Hat Migration Toolkit For Applications 6
- Red Hat Migration Toolkit For Applications 7
- Red Hat Amq Broker 7
- Red Hat Build Of Apicurio Registry 2
- Red Hat Build Of Keycloak 22 — versions 22.0.10-1, 22-13, 22-16
- Red Hat Build Of Keycloak 22.0.10
- Red Hat Build Of Quarkus
- Red Hat Data Grid 8
- Red Hat Decision Manager 7
- Red Hat Developer Hub
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2023-6717?
- CVE-2023-6717 is a medium-severity vulnerability in Red Hat Migration Toolkit For Applications 6, classified under Cross-site Scripting. CVSS score: 6.0/10. Published 2024-04-25.
- How severe is CVE-2023-6717?
- Medium severity. CVSS v3 base score is 6.0 out of 10.
- Is CVE-2023-6717 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.