The vulnerability of the OpenID Connect Login service for the Keycloak identity and access management software allows a hacker to disclose protected information, alter the appearance of the web page, and perform phishing attacks.

🗓️ 12 Apr 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

The OpenID Connect Login vulnerability in Keycloak allows disclosure of sensitive information, page tampering, and phishing due to weak website structure protection.

Reporter	Title	Published	Views	Family All 28
ATTACKERKB	CVE-2022-4137	25 Sep 202320:15	–	attackerkb
Circl	CVE-2022-4137	26 Sep 202300:34	–	circl
CNNVD	Red Hat Keycloak 跨站脚本漏洞	1 Mar 202300:00	–	cnnvd
CVE	CVE-2022-4137	25 Sep 202319:17	–	cve
Cvelist	CVE-2022-4137 Keycloak: reflected xss attack	25 Sep 202319:17	–	cvelist
EUVD	EUVD-2023-0968	3 Oct 202520:07	–	euvd
Github Security Blog	Keycloak Cross-site Scripting on OpenID connect login service	1 Mar 202317:38	–	github
NVD	CVE-2022-4137	25 Sep 202320:15	–	nvd
OSV	CVE-2022-4137	25 Sep 202320:15	–	osv
OSV	GHSA-9HHC-PJ4W-W5RV Keycloak Cross-site Scripting on OpenID connect login service	1 Mar 202317:38	–	osv

Vulners

Node

red_hat keycloakRange19.0.3–20.0.4

red_hat red_hat_single_sign-onMatch7.6

red_hat keycloakMatch22.0.1

Source	Link
access	www.access.redhat.com/security/cve/cve-2022-4137
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2023030250
web	www.web.nvd.nist.gov/view/vuln/detail

15 Sep 2023 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 38.1

CVSS 29.4

EPSS0.01149