Kurz gesagt
- CVE-2022-4137 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in org.keycloak:keycloak-parent, single sign-on (redhat).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 68.0% aller Schwachstellen.
- Abhilfe: auf 20.0.5 oder neuer aktualisieren.
Description
A reflected cross-site scripting (XSS) vulnerability was found in the oob OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.
NVD description
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free