Cross-Site Scripting Vulnerability in Keycloak by Red Hat
CVE-2022-4361
Key Information:
Badges
What is CVE-2022-4361?
Keycloak, an open-source identity and access management solution developed by Red Hat, is affected by a cross-site scripting (XSS) vulnerability that arises in the context of SAML and OIDC providers. An attacker can exploit this vulnerability by modifying the AssertionConsumerServiceURL or redirect_uri parameters to inject and execute malicious scripts within the user's browser session. This compromise could lead to unauthorized access to sensitive information or user sessions, underscoring the importance of applying security updates and implementing best practices to safeguard against such attacks.
Affected Version(s)
keycloak 21.1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.