CVE-2024-4028: Keycloak-core: stored xss in keycloak when creating a items in admin console
First published: Mon Apr 22 2024(Updated: )
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.keycloak:keycloak-core | <=26.1.2 | |
| Keycloak |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4028?
CVE-2024-4028 is considered a high-severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-4028?
To mitigate CVE-2024-4028, it is recommended to update the Keycloak software to the latest patched version provided by Red Hat.
Who is affected by CVE-2024-4028?
CVE-2024-4028 affects users of Red Hat Build of Keycloak, particularly those with permissions to create resources and permissions.
What exploit can CVE-2024-4028 enable?
CVE-2024-4028 can enable a privileged attacker to execute a stored XSS payload through the Keycloak admin console.
When was CVE-2024-4028 reported?
CVE-2024-4028 was reported in 2024, highlighting a critical vulnerability in the Keycloak admin interface.
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-4028
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-q4xq-445g-g6ch
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup-request
- package-manager/maven
- vendor/red hat
- canonical/keycloak