Cross-site Scripting (XSS)

2022-08-2903:30:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

keycloak

wildfly

add user

injection

malicious javascript

0.001 Low

EPSS

Percentile

24.8%

JSON

keycloak-wildfly-adduser is vulnerable to cross-site scripting. The vulnerability exists due to lack of escape in Add use parameter which allows a remote attacker to inject and execute malicious javascript into the system.

CPENameOperatorVersion
keycloak wildfly add user scriptle19.0.3
rh-sso7-keycloakeq3.4.3__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloakeq2.5.5__2.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq3.4.12__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq3.4.6__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq2.5.15__2.Final_redhat_3.1.jbcs.el7
rh-sso7-keycloakeq2.5.7__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloakeq2.5.10__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq3.4.8__2.Final_redhat_6.1.jbcs.el7
rh-sso7-keycloakeq2.4.0__4.Final_redhat_1.1.jbcs.el7

Name	Operator	Version
keycloak wildfly add user script	le	19.0.3
rh-sso7-keycloak	eq	3.4.3__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.5__2.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.12__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.6__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.15__2.Final_redhat_3.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.7__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.10__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.8__2.Final_redhat_6.1.jbcs.el7
rh-sso7-keycloak	eq	2.4.0__4.Final_redhat_1.1.jbcs.el7