CVE-2023-2585

Published Dec 21, 2023

Last updated 10 months ago

Overview

Description
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Source
secalert@redhat.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
8.1
Impact score
5.2
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity
HIGH

Weaknesses

nvd@nist.gov
NVD-CWE-Other
secalert@redhat.com
CWE-358

Social media

Hype score
Not currently trending

Configurations