~ / search / GHSA-9hhc-pj4w-w5rv

GHSA-9hhc-pj4w-w5rv

Keycloak Cross-site Scripting on OpenID connect login service

Source: GitHub Advisory Database (reviewed) High CVE-2022-4137

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-parent < 20.0.5 20.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability was found in the `oob` OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.

References

External links from the advisory. They lead to third-party sites.