U.S. Dept Of Defense: Reflected XSS via Keycloak on ███ [CVE-2021-20323]

The Keycloak 8.0 and prior versions contained a cross-site scripting vulnerability. An attacker could have executed arbitrary script by inserting a malicious payload in the path of a POST request to the /auth/realms/master/clients-registrations/openid-connect endpoint. This allowed the server to...

CVE-2021-20323

creationtimestamp| type| source ---|---|--- 2022-03-25 21:30:59+00:00| seen| https://t.me/cibsecurity/39556 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-20323.yaml...

CVE-2021-20323

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak...

CVE-2021-20323

Keycloak 10.0.0–18.0.0 contains a post-based reflected XSS via the client-registrations endpoint. The root cause is that a JSON key value is echoed in an error response with Content-Type: text/html, enabling HTML/JS execution in the user’s browser when a POST is used. Impact includes potential ar...

CVE-2021-20323

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak...

CVE-2021-20323

A flaw has been found in Keycloak. The clients-registrations endpoint allows execution of javascript code on the client-side, which makes it vulnerable to a Cross-Site Scripting attack...