PT-2023-3319 · Red Hat · Keycloak

Mulliken · Publicado 2023-06-27 · Atualizado 2023-07-17 · CVE-2022-4361

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions (affected versions not specified)

Description The issue is related to a cross-site scripting (XSS) vulnerability in Keycloak, an open-source identity and access management solution. This vulnerability can be exploited by setting the AssertionConsumerServiceURL value or the redirect uri, allowing an attacker to execute malicious scripts. The vulnerability is also related to the lack of filtering of a non-existent web page name when generating a 404 error page, which can lead to the execution of arbitrary scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

CWE-81

Identificadores relacionados

BDU:2023-03467

CVE-2022-4361

GHSA-3P62-6FJH-3P5H

RHSA-2023:3883

RHSA-2023:3884

RHSA-2023:3885

Produtos afetados

Keycloak

Referências · 10

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a · Correção
• https://github.com/keycloak/keycloak/security/advisories/GHSA-3p62-6fjh-3p5h · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-4361 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=2151618 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03467 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3p62-6fjh-3p5h · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2022-4361 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4361 · Nota
• https://osv.dev/vulnerability/CVE-2022-4361 · Aviso do Fabricante