PT-2023-3319 · Red Hat · Keycloak

Mulliken · Published 2023-06-27 · Updated 2023-07-17 · CVE-2022-4361

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions (affected versions not specified)

Description The issue is related to a cross-site scripting (XSS) vulnerability in Keycloak, an open-source identity and access management solution. This vulnerability can be exploited by setting the AssertionConsumerServiceURL value or the redirect uri, allowing an attacker to execute malicious scripts. The vulnerability is also related to the lack of filtering of a non-existent web page name when generating a 404 error page, which can lead to the execution of arbitrary scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-81

CWE-79

Related Identifiers

BDU:2023-03467

CVE-2022-4361

GHSA-3P62-6FJH-3P5H

RHSA-2023:3883

RHSA-2023:3884

RHSA-2023:3885

Affected Products

Keycloak

References · 10

• https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a · Patch
• https://osv.dev/vulnerability/GHSA-3p62-6fjh-3p5h · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2151618 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-4361 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4361 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-3p62-6fjh-3p5h · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4361 · Note
• https://access.redhat.com/security/cve/cve-2022-4361 · Note