PT-2022-6913 · Red Hat · Keycloak

Marian Rehak · Published 2022-03-25 · Updated 2025-07-12 · CVE-2021-20323

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 17.0.0

Description A POST based reflected Cross Site Scripting vulnerability has been identified in Keycloak. The issue exists due to inadequate protection of the web page structure, allowing a remote attacker to execute arbitrary code. The vulnerability can be exploited via a reflected XSS attack.

Recommendations For Keycloak versions prior to 17.0.0, update to version 17.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to vulnerable API endpoints until a patch is available. Avoid using the Content-Type header with the value application/json in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05599

CVE-2021-20323

GHSA-XPGC-J48J-JWV9

Affected Products

Keycloak

References · 19

• 🔥 https://github.com/ndmalc/CVE-2021-20323 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20323 · Security Note
• https://osv.dev/vulnerability/GHSA-xpgc-j48j-jwv9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05599 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20323 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://twitter.com/bountywriteups/status/1786999436817596721 · Twitter Post
• https://twitter.com/cappricio_sec/status/1890740343911715160 · Twitter Post
• https://vuldb.com/ru/?id.195842 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2013577 · Note
• https://twitter.com/h1Disclosed/status/1786470984226078753 · Twitter Post
• https://twitter.com/shivangmauryaa/status/1854576776350970312 · Twitter Post
• https://twitter.com/H_Mosafer/status/1743609740444188726 · Twitter Post
• https://t.me/pentestingnews/53230 · Telegram Post
• https://access.redhat.com/security/cve/cve-2021-20323 · Note