GitHub Advisoryadvisory · Maven

GHSA-w9mf-83w3-fv49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

MEDIUM Published 2022-09-23 Modified 2022-10-18 Official page ↗
Aliases
CVE-2022-2256
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-09-23

Affected packages

• Maven org.keycloak:keycloak-parent: < 19.0.2 → fixed in 19.0.2

Description

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (18.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality. CVSS 3.1 - 3.8 Vector String: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N Vector Clarification: • User interaction is not required as the admin console is regularly used during an administrator's work • The scope is unchanged since the admin console web application is both the vulnerable component and where the exploit executes Credits Aytaç Kalıncı, Ilker Bulgurcu, Yasin Yılmaz (@aytackalinci, @smileronin, @yasinyilmaz) - NETAŞ PENTEST TEAM

Related

Alias · CVE (1)

  • CVE-2022-2256 A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References