CVE-2022-2256: XSS
A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.
Other sources
A Stored Cross-site scripting (XSS) vulnerability was found in keycloak. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.
Keycloak does not properly sanitize inputs in certain UI fields in client registration. A malicious authenticated user with administrative privileges could use this flaw to conduct cross-site scripting attacks and possibly gain access to user-sensitive information.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-2256?
CVE-2022-2256 is a Stored Cross-site scripting (XSS) vulnerability found in keycloak as shipped in Red Hat Single Sign-On 7.
How does CVE-2022-2256 affect Red Hat Single Sign-On 7?
CVE-2022-2256 allows a privileged attacker to execute malicious scripts in the admin console of Red Hat Single Sign-On 7, abusing the default roles functionality.
What is the severity of CVE-2022-2256?
CVE-2022-2256 has a severity rating of 3.8 (low).
How can I fix CVE-2022-2256 in Red Hat Single Sign-On 7?
To fix CVE-2022-2256 in Red Hat Single Sign-On 7, update to version 0:15.0.8-1.redhat_00001.1.el7 (or later) for el7 or version 0:15.0.8-1.redhat_00001.1.el8 (or later) for el8.
Where can I find more information about CVE-2022-2256?
You can find more information about CVE-2022-2256 at the following references: [RHSA-2022:6782](https://access.redhat.com/errata/RHSA-2022:6782), [RHSA-2022:6783](https://access.redhat.com/errata/RHSA-2022:6783), [RHSA-2022:6787](https://access.redhat.com/errata/RHSA-2022:6787).