PT-2023-5051 · Red Hat · Keycloak

Mulliken · Published 2023-02-27 · Updated 2023-09-25 · CVE-2022-1438

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:H/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak, where under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability. This issue can be exploited by an attacker to conduct a Cross-site scripting attack. The vulnerability is related to insufficient protection measures for the web page structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-05596

CVE-2022-1438

GHSA-W354-2F3C-QVG9

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Affected Products

Keycloak

References · 21

• https://access.redhat.com/security/cve/CVE-2022-1438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1438 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1438 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05596 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2031904 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:1045 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:1044 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:1049 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:1047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w354-2f3c-qvg9 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:1043 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-w354-2f3c-qvg9 · Note
• https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1438 · Note