PT-2023-5051 · Red Hat · Keycloak

Mulliken · Publicado 2023-02-27 · Atualizado 2023-09-25 · CVE-2022-1438

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:H/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak, where under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability. This issue can be exploited by an attacker to conduct a Cross-site scripting attack. The vulnerability is related to insufficient protection measures for the web page structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-05596

CVE-2022-1438

GHSA-W354-2F3C-QVG9

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Produtos afetados

Keycloak

Referências · 21

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/security/advisories/GHSA-w354-2f3c-qvg9 · Nota
• https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1438 · Nota
• https://access.redhat.com/security/cve/CVE-2022-1438 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-1438 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-1438 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05596 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=2031904 · Aviso do Fabricante
• https://vuldb.com/ru/?id.222113 · Nota
• https://access.redhat.com/errata/RHSA-2023:1045 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:1044 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:1049 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:1047 · Aviso do Fabricante
• https://twitter.com/DMFezzaReedCISA/status/1704529666797670736 · Publicação no Twitter