CVE-2023-2585: redhat openshift_container_platform

Vulnerability summary

CVE-2023-2585 is a high (CVSS 8.1) vulnerability in redhat openshift_container_platform. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52% of scored vulnerabilities.

Timeline

1. 21-12-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.

• CWE-358Improperly Implemented Security Check for StandardThe product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.