CVE-2021-20195 — Improper Input Validation in Redhat Keycloak

CWE-20 — Improper Input ValidationCWE-116 — Improper Encoding or Escaping of OutputCWE-79 — Cross-site Scripting5 documents5 sources
Severity
9.6CRITICALNVD
EPSS
0.3%
top 46.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Keycloak
Timeline
PublishedMay 28
Latest updateJun 8

Description

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 2.8 | Impact: 6.0

Affected Packages2 packages

▶NVDredhat/keycloak< 12.0.3
▶CVEListV5redhat/keycloakkeycloak 13.0.0

🔴Vulnerability Details

3
OSV
keycloak Self Stored Cross-site Scripting vulnerability↗2021-06-08
▶
GHSA
keycloak Self Stored Cross-site Scripting vulnerability↗2021-06-08
▶
CVEList
CVE-2021-20195: A flaw was found in keycloak in versions before 13↗2021-05-28
▶

📋Vendor Advisories

1
Red Hat
keycloak: The Account console allows stored self-XSS via impersonation mechanism↗2021-02-16
▶
CVE-2021-20195 — Improper Input Validation in Redhat | cvebase