PT-2022-18005 · Red Hat · Keycloak

Marek Posolda · Published 2022-08-05 · Updated 2022-09-23 · CVE-2022-2668

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD SCRIPTS feature is disabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-2668

GHSA-Q2GP-GPH3-88X9

GHSA-WF7G-7H6H-678V

RHSA-2022:6782

RHSA-2022:6783

RHSA-2022:7409

RHSA-2022:7410

RHSA-2022:7411

Affected Products

Keycloak

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-2668 · Security Note
• https://osv.dev/vulnerability/GHSA-wf7g-7h6h-678v · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2022-2668 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q2gp-gph3-88x9 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v · Note
• https://github.com/keycloak/keycloak/commit/e2ae7eef39b27e48ffa4764995d558555f02838c · Note
• https://t.me/cvenotify/34600 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2668 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2115392 · Note