PT-2023-12689 · Red Hat · Keycloak Node.Js Adapter

Pedro Sampaio · Published 2023-03-02 · Updated 2025-02-24 · CVE-2022-2237

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak Node.js Adapter (affected versions not specified)

Description A flaw was found in the Keycloak Node.js Adapter, allowing an attacker to benefit from an Open Redirect vulnerability in the checkSso function. This issue is also present when forwarding requests to Keycloak using the checkSSO function with the query parameter prompt=none.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-2237

GHSA-59FQ-727J-HM3F

Affected Products

Keycloak Node.Js Adapter

References · 10

• https://osv.dev/vulnerability/CVE-2022-2237 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59fq-727j-hm3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2237 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2097007 · Vendor Advisory
• https://github.com/keycloak/keycloak-nodejs-connect · Note
• https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f · Note
• https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21 · Note
• https://t.me/cvenotify/112354 · Telegram Post
• https://t.me/cvenotify/46967 · Telegram Post
• https://t.me/cvenotify/47464 · Telegram Post