CVE-2023-6484

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - secalert@redhat.com

Published

2024-04-25

Last modified

2026-06-26

Weaknesses

CWE-117

Affected products

• Build Keycloak (Redhat)
• Red Hat Single Sign On (Redhat)
• Rhosemc (Redhat)

References

• https://access.redhat.com/errata/RHSA-2024:0798
• https://access.redhat.com/errata/RHSA-2024:0799
• https://access.redhat.com/errata/RHSA-2024:0800
• https://access.redhat.com/errata/RHSA-2024:0801
• https://access.redhat.com/errata/RHSA-2024:0804
• https://access.redhat.com/errata/RHSA-2024:1860
• https://access.redhat.com/errata/RHSA-2024:1861
• https://access.redhat.com/errata/RHSA-2024:1862
• https://access.redhat.com/errata/RHSA-2024:1864
• https://access.redhat.com/errata/RHSA-2024:1865
• https://access.redhat.com/errata/RHSA-2024:1866
• https://access.redhat.com/errata/RHSA-2024:1867
• https://access.redhat.com/errata/RHSA-2024:1868
• https://access.redhat.com/security/cve/CVE-2023-6484
• https://bugzilla.redhat.com/show_bug.cgi?id=2248423
• https://github.com/advisories/GHSA-j628-q885-8gr5