PT-2023-5052 · Red Hat · Keycloak

Marcus Nilsson · Published 2023-02-27 · Updated 2023-12-22 · CVE-2022-1274

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in the "execute-actions-email" endpoint of Keycloak, allowing arbitrary HTML to be injected into emails sent to Keycloak users. This issue can be misused to perform phishing or other attacks against users, essentially conducting a cross-site scripting (XSS) attack. The flaw is related to inadequate protection measures of the web page structure.

Recommendations As a temporary workaround, consider disabling the execute-actions-email endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint to send emails containing potentially malicious content until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

BDU:2023-05597

CVE-2022-1274

GHSA-M4FV-GM5M-4725

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Affected Products

Keycloak

References · 17

• https://osv.dev/vulnerability/GHSA-m4fv-gm5m-4725 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05597 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1274 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2073157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1274 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725 · Note
• https://github.com/keycloak/keycloak/commit/fc3c61235fa30132123c17ed8702ff7b3a672fe9 · Note
• https://github.com/keycloak/keycloak/pull/16764 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1274 · Note
• https://cybersecurity-help.cz/vdb/SB2023030250 · Note
• https://github.com/advisories/GHSA-m4fv-gm5m-4725 · Note
• https://access.redhat.com/security/cve/cve-2022-1274 · Note
• https://herolab.usd.de/security-advisories/usd-2021-0033 · Note
• https://vuldb.com/ru/?id.222112 · Note