CVE-2022-2668
highpriority · track · 29EPSS 0.010 · 63 %ileEUUSEPSS · scored 2026-10-27
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–7.2
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-wf7g-7h6h-678vKeycloak SAML javascript protocol mapper: Uploading of scripts through admin console2022-09-23ghsa · osvUS
An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the `UPLOAD_SCRIPTS` feature is disabled
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2022-2668cnnvd
- https://access.redhat.com/security/cve/cve-2022-2668cnnvd
- https://cxsecurity.com/cveshow/CVE-2022-2668/cnnvd
- https://packetstormsecurity.com/files/168631/Red-Hat-Security-Advisory-2022-6782-01.htmlcnnvd
- https://packetstormsecurity.com/files/169727/Red-Hat-Security-Advisory-2022-7417-01.htmlcnnvd
- https://packetstormsecurity.com/files/169729/Red-Hat-Security-Advisory-2022-7410-01.htmlcnnvd
- https://vigilance.fr/vulnerability/Keycloak-code-execution-via-SAML-Protocol-Mapper-Javascript-Upload-39469cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.5594cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan