CVE-2022-4361

2023-07-0719:57:44

CWE-81

redhat

www.cve.org

cve-2022-4361

keycloak

cross-site scripting

saml

oidc

vulnerability

attacker

malicious scripts

assertionconsumerserviceurl

redirect_uri

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

CNA Affected

[
  {
    "vendor": "keycloak",
    "product": "keycloak",
    "versions": [
      {
        "status": "unaffected",
        "version": "21.1.2"
      }
    ],
    "defaultStatus": "unaffected"
  }
]