Lucene search
Veracode Vulnerability DatabaseVERACODE:39494HistoryMar 02, 2023 - 7:11 p.m.
Cross-site Scripting (XSS)
2023-03-0219:11:36
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
125
keycloak
cross-site scripting
remote attacker
arbitrary uri
error page
null-byte handling
vulnerability
oauth
0.001 Low
EPSS
Percentile
37.1%
org.keycloak:keycloak-services is vulnerable to Cross-site Scripting (XSS) attacks. A remote attacker is able to insert an arbitrary URI into an error page via the oob OAuth endpoint due to incorrect null-byte handling.
References
access.redhat.com/errata/RHSA-2023:1043
access.redhat.com/errata/RHSA-2023:1044
access.redhat.com/errata/RHSA-2023:1045
access.redhat.com/errata/RHSA-2023:1049
access.redhat.com/security/cve/CVE-2022-4137
bugzilla.redhat.com/show_bug.cgi?id=2148496
github.com/advisories/GHSA-9hhc-pj4w-w5rv
github.com/keycloak/keycloak/commit/30d0e9d22dae51392e5a3748a1c68c116667359a
github.com/keycloak/keycloak/pull/16774
Related
cvelist
cvelist
CVE-2022-4137 Keycloak: reflected xss attack
2023-09-25 19:17:55
github
github
Keycloak Cross-site Scripting on OpenID connect login service
2023-03-01 17:38:56
redhatcve
redhatcve
CVE-2022-4137
2023-03-01 13:59:36
cve
cve
CVE-2022-4137
2023-09-25 20:15:09
nvd
nvd
CVE-2022-4137
2023-09-25 20:15:09
osv
osv
Keycloak Cross-site Scripting on OpenID connect login service
2023-03-01 17:38:56
prion
prion
Cross site scripting
2023-09-25 20:15:00
nessus
nessus
redhat
redhat