CVE-2024-8883
moderate-risk
Published 2024-09-19
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Do I need to act?
~
5.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10
Medium
NETWORK
/ LOW complexity
Affected Products (11)
Openshift Container Platform For Ibm Z
Openshift Container Platform For Ibm Z
Openshift Container Platform For Linuxone
Openshift Container Platform For Linuxone
Affected Vendors
References (17)
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6878
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6879
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6880
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6882
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6886
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6887
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6888
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6889
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:6890
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-8883
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2312511
47
/ 100
moderate-risk
Severity
23/34 · High
Exploitability
8/34 · Low
Exposure
16/34 · Moderate