Keycloak: reflected xss attack
CVE-2022-4137
8.1HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 25 September 2023
What is CVE-2022-4137?
A reflected cross-site scripting (XSS) vulnerability exists in Keycloak's 'oob' OAuth endpoint due to improper handling of null bytes. This security flaw enables attackers to craft malicious links that, when clicked by an unsuspecting user or administrator, result in the injection of arbitrary URIs into Keycloak error pages. Such exploitation may allow an attacker to manipulate or gather sensitive user information.
Affected Version(s)
Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.6-1.redhat_00001.1.el7sso
Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.6-1.redhat_00001.1.el8sso
Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.6-1.redhat_00001.1.el9sso