GHSA-2mq8-99q7-55wx

Code injection in keycloak

En bref

Publiée: 2021-05-13 22:29 UTC
Mise à jour: 2023-11-08 04:04 UTC
CVE: CVE-2021-20222
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Paquets affectés

Paquet	Versions
Maven · org.keycloak:keycloak-parent	introduced 9.0.0, fixed 12.0.3

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-20222 ADVISORY
https://github.com/keycloak/keycloak/commit/3b80eee5bfdf2b80c47465c0f2eaf70074808741 WEB
https://access.redhat.com/security/cve/cve-2021-20222 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1924606 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database