CVE-2023-6717

MediumCVSS 6.0/10Last modified Sep 11, 2026

Description

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2024
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-67187.5An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to CVE-2023-67196.1An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable appli CVE-2023-67205.4An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on t CVE-2023-67217.5An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the CVE-2023-67227.5A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting CVE-2023-67239.8An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transfor CVE-2023-67248.8Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing CVE-2023-67255.5An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND CVE-2023-67274.3Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to c CVE-2023-67283.3Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted f CVE-2023-67297.3Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequent CVE-2023-67308.8Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.