GitHub Advisoryadvisory · Maven

GHSA-3p62-6fjh-3p5h Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

CRITICAL Published 2023-06-30 Modified 2023-07-07 Official page ↗
Aliases
CVE-2022-4361
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-79, CWE-81
Reviewed
2023-06-30

Affected packages

• Maven org.keycloak:keycloak-services: < 21.1.2 → fixed in 21.1.2

Description

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS). AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.

Related

Alias · CVE (1)

  • CVE-2022-4361 Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC… vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-81 Improper Neutralization of Script in an Error Message Web Page weakness

References