CVE-2022-2237: Medium severity redhat Keycloak Node.js Adapter vulnerability
A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.
Other sources
checkSSO uses the query param 'prompt=none' when forwarding the request to KeyCloak. This may allow authenticating the user without interaction as long as the user is already authenticated with KeyCloak.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-2237?
CVE-2022-2237 is a vulnerability found in the Keycloak Node.js Adapter that allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.
What is the severity of CVE-2022-2237?
The severity of CVE-2022-2237 is medium, with a CVSS score of 6.1.
Which software is affected by CVE-2022-2237?
The Redhat Keycloak Node.js Adapter and Redhat Single Sign-on version 7.0 are affected by CVE-2022-2237.
How can an attacker exploit CVE-2022-2237?
An attacker can exploit CVE-2022-2237 by taking advantage of the Open Redirect vulnerability in the checkSso function.
Are there any references available for CVE-2022-2237?
Yes, you can find references for CVE-2022-2237 at the following URLs: [https://access.redhat.com/errata/RHSA-2023:1049](https://access.redhat.com/errata/RHSA-2023:1049) and [https://bugzilla.redhat.com/show_bug.cgi?id=2097007](https://bugzilla.redhat.com/show_bug.cgi?id=2097007).