CVE-2022-0225 — Cross-site Scripting in Redhat Keycloak

CWE-79 — Cross-site ScriptingCWE-416 — Use After Free6 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.5%
top 34.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat KeycloakRedhat Single Sign-on
Timeline
PublishedAug 26
Latest updateAug 27

Description

A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5redhat/keycloakNot-Known

🔴Vulnerability Details

3
OSV
Keycloak XSS via use of malicious payload as group name when creating new group from admin console↗2022-08-27
▶
GHSA
Keycloak XSS via use of malicious payload as group name when creating new group from admin console↗2022-08-27
▶
CVEList
CVE-2022-0225: A flaw was found in Keycloak↗2022-08-26
▶

📋Vendor Advisories

2
Red Hat
vim: use-after-free in find_var_also_in_script() in evalvars.c↗2022-08-16
▶
Red Hat
keycloak: Stored XSS in groups dropdown↗2022-01-13
▶
CVE-2022-0225 — Cross-site Scripting in Redhat Keycloak | cvebase