CVE-2022-0225

2022-08-2617:25:46

CWE-79

redhat

www.cve.org

keycloak

stored xss

admin console

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.

CNA Affected

[
  {
    "product": "keycloak",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Not-Known"
      }
    ]
  }
]