{"action":"Upgrade org.keycloak:keycloak-server-spi-private to 21.1.2 or later.","affected":[{"fixed":"21.1.2","introduced":"0"}],"component":"org.keycloak:keycloak-server-spi-private","cve_ids":["CVE-2023-2585"],"ecosystem":"Maven","epss":0.00694,"exploited":false,"fixed_versions":["21.1.2"],"ghsa_id":"GHSA-f5h4-wmp5-xhg6","id":"tcs_01M5N8V2T5GYG2RRJQ5J2DHMX8","modified_at":"2024-02-16T08:14:33.799348Z","published_at":"2023-06-30T20:29:25Z","references":["https://osv.dev/vulnerability/GHSA-f5h4-wmp5-xhg6","https://github.com/keycloak/keycloak/security/advisories/GHSA-f5h4-wmp5-xhg6","https://nvd.nist.gov/vuln/detail/CVE-2023-2585","https://github.com/keycloak/keycloak/commit/04e6244c387a1bde86184635a0049537611e3915","https://access.redhat.com/errata/RHSA-2023:3883","https://access.redhat.com/errata/RHSA-2023:3884","https://access.redhat.com/errata/RHSA-2023:3885","https://access.redhat.com/errata/RHSA-2023:3888","https://access.redhat.com/errata/RHSA-2023:3892","https://access.redhat.com/security/cve/CVE-2023-2585","https://bugzilla.redhat.com/show_bug.cgi?id=2196335","https://github.com/keycloak/keycloak"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-f5h4-wmp5-xhg6#Maven/org.keycloak:keycloak-server-spi-private","url":"https://osv.dev/vulnerability/GHSA-f5h4-wmp5-xhg6"}],"summary":"Client Spoofing within the Keycloak Device Authorisation Grant"}