GitHub Advisoryadvisory · Maven

GHSA-458h-wv48-fq75 Keycloak vulnerable to cross-site scripting via the state parameter

MEDIUM Published 2022-05-13 Modified 2023-10-19 Official page ↗
Aliases
CVE-2018-14655
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-21

Affected packages

• Maven org.keycloak:keycloak-parent: <= 3.4.3.Final (no fix yet) • Maven org.keycloak:keycloak-parent: >= 4.0.0.Beta1, <= 4.0.0.Beta2 (no fix yet) • Maven org.keycloak:keycloak-parent: 4.3.0.Final (no fix yet)

Description

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using `response_mode=form_post` it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

Related

Alias · CVE (1)

  • CVE-2018-14655 A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References