GHSA-wf7g-7h6h-678v

Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

Source: GitHub Advisory Database (reviewed) High CVE-2022-2668

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.keycloak:keycloak-parent	< 19.0.2	19.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the `UPLOAD_SCRIPTS` feature is disabled

References

External links from the advisory. They lead to third-party sites.

https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v web
https://nvd.nist.gov/vuln/detail/CVE-2022-2668 advisory
https://github.com/keycloak/keycloak/commit/e2ae7eef39b27e48ffa4764995d558555f02838c web
https://access.redhat.com/security/cve/CVE-2022-2668 web
https://bugzilla.redhat.com/show_bug.cgi?id=2115392 web
https://github.com/keycloak/keycloak package