CVE-2022-4137

HIGH8.1EPSS 0.53%

Keycloak Cross-site Scripting on OpenID connect login service

Published: 3/1/2023Modified: 2/16/2024

Description

A reflected cross-site scripting (XSS) vulnerability was found in the `oob` OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.

Affected packages (1)

Maven/org.keycloak:keycloak-parentfrom 0, < 20.0.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References (11)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-4137
PATCHhttps://github.com/keycloak/keycloak
WEBhttps://access.redhat.com/errata/RHSA-2023:1043
WEBhttps://access.redhat.com/errata/RHSA-2023:1044
WEBhttps://access.redhat.com/errata/RHSA-2023:1045
WEBhttps://access.redhat.com/errata/RHSA-2023:1049
WEBhttps://access.redhat.com/security/cve/CVE-2022-4137
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2148496
WEBhttps://github.com/keycloak/keycloak/commit/30d0e9d22dae51392e5a3748a1c68c116667359a
WEBhttps://github.com/keycloak/keycloak/pull/16774
WEBhttps://github.com/keycloak/keycloak/security/advisories/GHSA-9hhc-pj4w-w5rv