CVE-2022-4137: Keycloak: reflected xss attack
A flaw was found in Keycloak package. This flaw allows an attacker to benefit from Cross-Site Scripting by sending a script via URL. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise the user details, may it be changed or collected by the attacker. An administrator who might be affected may also compromise the server data.
Other sources
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.
A reflected cross-site scripting (XSS) vulnerability was found in the oob OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-4137?
CVE-2022-4137 is a reflected cross-site scripting (XSS) vulnerability found in the 'oob' OAuth endpoint of Keycloak.
What is the severity of CVE-2022-4137?
The severity of CVE-2022-4137 is high, with a CVSS score of 8.1.
What is the affected software for CVE-2022-4137?
The affected software for CVE-2022-4137 includes Redhat Keycloak, Redhat Single Sign-on, and Redhat Enterprise Linux (versions 7.0, 8.0, 9.0).
How does CVE-2022-4137 work?
CVE-2022-4137 allows a malicious link to insert an arbitrary URI into a Keycloak error page through the 'oob' OAuth endpoint.
How can I fix CVE-2022-4137?
To fix CVE-2022-4137, update your Keycloak installation to versions 0:18.0.6-1.redhat_00001.1.el7, 0:18.0.6-1.redhat_00001.1.el8, or 0:18.0.6-1.redhat_00001.1.el9.