GHSA-2mq8-99q7-55wx

ghsaUSosv

Code injection in keycloak

view advisory published 2021-05-13Licence: CC-BY-4.0

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-20222US	high7.5	1.19% (68th)	—	2021-03-23
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to d…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/cve-2021-20222WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1924606WEB
https://github.com/keycloak/keycloak/commit/3b80eee5bfdf2b80c47465c0f2eaf70074808741WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-20222ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan