PT-2023-5052 · Red Hat · Keycloak
Marcus Nilsson
·
Publicado
2023-02-27
·
Atualizado
2023-12-22
·
CVE-2022-1274
CVSS v2.0
5.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Keycloak (affected versions not specified)
Description
A flaw was found in the "execute-actions-email" endpoint of Keycloak, allowing arbitrary HTML to be injected into emails sent to Keycloak users. This issue can be misused to perform phishing or other attacks against users, essentially conducting a cross-site scripting (XSS) attack. The flaw is related to inadequate protection measures of the web page structure.
Recommendations
As a temporary workaround, consider disabling the
execute-actions-email endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint to send emails containing potentially malicious content until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Keycloak