CVE-2021-20222: XSS
First published: Wed Feb 03 2021(Updated: )
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/keycloak | <13.0.0 | 13.0.0 |
| Redhat Keycloak | >=9.0.0<13.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://issues.redhat.com/browse/KEYCLOAK-17033
- https://access.redhat.com/security/cve/cve-2021-20222
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1922216
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1924606#c10
- https://issues.redhat.com/browse/KEYCLOAK-6197
- https://github.com/keycloak/keycloak-prod/pull/421
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1924606#c13
- https://bugzilla.redhat.com/show_bug.cgi?id=1924606
Frequently Asked Questions
What is CVE-2021-20222?
CVE-2021-20222 is a vulnerability found in Keycloak that allows execution of malicious code using the referrer URL.
What is the impact of CVE-2021-20222?
The highest threat from CVE-2021-20222 is to data confidentiality and integrity, as well as system availability.
How can CVE-2021-20222 be exploited?
CVE-2021-20222 can be exploited by using the referrer URL in the new account console in Keycloak to execute malicious code.
What versions of Keycloak are affected by CVE-2021-20222?
Keycloak versions up to but excluding 13.0.0 are affected by CVE-2021-20222.
How can I fix CVE-2021-20222?
To fix CVE-2021-20222, upgrade your Keycloak installation to version 13.0.0 or later.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-20222
- agent/software-canonical-lookup
- vendor/redhat
- canonical/redhat keycloak
- version/redhat keycloak/9.0.0
- package-manager/redhat