CVE-2021-20222: XSS
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Attacker can attach malicious code using the referrer URL using new account console.
https://issues.redhat.com/browse/KEYCLOAK-17033
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-20222?
CVE-2021-20222 is a vulnerability found in Keycloak that allows execution of malicious code using the referrer URL.
What is the impact of CVE-2021-20222?
The highest threat from CVE-2021-20222 is to data confidentiality and integrity, as well as system availability.
How can CVE-2021-20222 be exploited?
CVE-2021-20222 can be exploited by using the referrer URL in the new account console in Keycloak to execute malicious code.
What versions of Keycloak are affected by CVE-2021-20222?
Keycloak versions up to but excluding 13.0.0 are affected by CVE-2021-20222.
How can I fix CVE-2021-20222?
To fix CVE-2021-20222, upgrade your Keycloak installation to version 13.0.0 or later.