THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2023-6717 (MEDIUM 6.0) — A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one real

[NVD] CVE-2023-6717 (MEDIUM 6.0) — A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one real

lownvdPublished 2024-04-25

CVE-2023-6717 CVSS: 6.0 MEDIUM Published: 2024-04-25T16:15:10.653

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target user

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2023-6717cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2023-6717