Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown

中 5.4CVE-2022-0225 · GHSA-755v-r4x4-qf7m · GHSA-fqc7-5xxc-ph7r · 26/08/2022 公開 · 17/06/2026 更新

要点

CVE-2022-0225 は org.keycloak:keycloak-core, single sign-on (redhat) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.2%（全脆弱性の 88.1% より高い）。
対処：20.0.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-core Maven	`≤ 16.1.0< 20.0.0`	`20.0.0`
single sign-on redhat	`= 7.0`	修正版なし

概要

Summary

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (16.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown functionality.

Impact

Successful attacks of this vulnerability can result a privileged attacker to load a XSS script, and steal data from other users. The impact can be considered moderate to low, considering privileged credentials are required.

References

Please refer to the Keycloak Security mailing list for more information.

NVD の説明

A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.