CVE-2018-14655: XSS
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Other sources
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using "responsemode=formpost" it is possible to inject arbitrary Javascript-Code via the "state"-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
— Red Hat
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using responsemode=formpost it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-14655?
CVE-2018-14655 is a vulnerability found in Keycloak 3.4.3.Final, 4.0.0.Beta2, and 4.3.0.Final that allows an XSS-Attack upon successful login by injecting arbitrary JavaScript code via the 'state'-parameter in the authentication URL.
How severe is CVE-2018-14655?
CVE-2018-14655 has a severity rating of medium, with a CVSS score of 5.4.
Which software versions are affected by CVE-2018-14655?
Keycloak versions 3.4.3.Final, 4.0.0.Beta2, and 4.3.0.Final are affected by CVE-2018-14655.
How can I fix CVE-2018-14655?
To fix CVE-2018-14655, it is recommended to update Keycloak to a version that is not affected, such as a version newer than 4.3.0.Final.
Where can I find more information about CVE-2018-14655?
You can find more information about CVE-2018-14655 on the NIST NVD website and the Red Hat security advisories RHSA-2018:3592 and RHSA-2018:3593.