CVE-2022-4361: XSS
AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).
AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
Other sources
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirecturi.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 21.1.2
Event History
Frequently Asked Questions
What is CVE-2022-4361?
CVE-2022-4361 is a cross-site scripting (XSS) vulnerability in Keycloak, an open-source identity and access management solution.
Which software is affected by CVE-2022-4361?
Keycloak versions up to 21.1.2, Redhat Single Sign-on versions up to 7.6.4, and certain versions of Redhat Openshift Container Platform are affected by CVE-2022-4361.
How severe is CVE-2022-4361?
CVE-2022-4361 has a severity level of 6.1 (Critical).
How does CVE-2022-4361 work?
CVE-2022-4361 allows an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
How can I fix CVE-2022-4361?
To fix CVE-2022-4361, it is recommended to update to the latest versions of Keycloak, Redhat Single Sign-on, or Redhat Openshift Container Platform.