#VU88793 Improper authorization in Keycloak - CVE-2023-6544
Published: April 17, 2024
Vulnerability identifier: #VU88793
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-6544
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Keycloak
Keycloak
Software vendor:
Keycloak
Keycloak
Description
The vulnerability allows a remote attacker to gain unauthorized access to the application.
The vulnerability exists due to a permissive regular expression hard-coded for filtering allowed hosts to register a dynamic client within the org.keycloak.services.clientregistration package. A remote attacker with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.
Remediation
Install updates from vendor's website.