GitHub Advisoryadvisory · Maven

GHSA-m98g-63qj-fp8j Reflected XSS on clients-registrations endpoint

MEDIUM Published 2022-04-28 Modified 2022-04-28 Official page ↗
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-04-28

Affected packages

• Maven org.keycloak:keycloak-parent: >= 10.0.0, < 18.0.0 → fixed in 18.0.0

Description

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser. Acknowledgement Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References