PT-2021-13833 · Red Hat · Keycloak

Amit Laish + 1 · Published 2021-05-28 · Updated 2022-08-05 · CVE-2021-20195

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: keycloak versions prior to 13.0.0

Description: A flaw in keycloak allows for a Self Stored XSS attack vector, which can escalate to a complete account takeover. This is due to user-supplied data fields not being properly encoded and the use of Javascript code to process the data. The highest threat from this issue is to data confidentiality and integrity, as well as system availability.

Recommendations: For versions prior to 13.0.0, update to version 13.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of user-supplied data fields in Javascript code until a patch is available. Restrict access to sensitive data and functions to minimize the risk of exploitation.

Fix

XSS

Improper Encoding or Escaping of Output

RCE

Weakness Enumeration

CWE-79

CWE-116

CWE-20

Related Identifiers

CVE-2021-20195

GHSA-Q6W2-89HQ-HQ27

Affected Products

Keycloak

References · 6

• https://osv.dev/vulnerability/CVE-2021-20195 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1919143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20195 · Security Note
• https://osv.dev/vulnerability/GHSA-q6w2-89hq-hq27 · Vendor Advisory
• https://github.com/keycloak/keycloak/commit/717d9515fa131e3d8c8936e41b2e52270fdec976 · Note
• https://t.me/cvenotify/15409 · Telegram Post