REDHAT-BUG-1144994: Low severity keycloak vulnerability

Published Sep 22, 2014

Updated

If a JBoss Keycloak application has configured as a permitted web origin in the Keycloak administrative console, crafted requests to the login-status-iframe.html endpoint can inject arbitrary Javascript into the generated HTML code via the "origin" query parameter, leading to a cross-site scripting vulnerability.

Affected Software

1 affected component

Red Hat Keycloak

Event History

Sep 22, 2014

Data Sourced

07:48 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1144994?

REDHAT-BUG-1144994 is considered a high severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix REDHAT-BUG-1144994?

To fix REDHAT-BUG-1144994, ensure that you do not configure '*' as a permitted web origin in the Keycloak administrative console.

What impact does REDHAT-BUG-1144994 have on security?

REDHAT-BUG-1144994 can lead to the injection of arbitrary JavaScript, compromising the security of users interacting with the vulnerable Keycloak application.

Which applications are affected by REDHAT-BUG-1144994?

REDHAT-BUG-1144994 affects applications that use Red Hat Build of Keycloak with misconfigured web origin settings.

Is there a patch available for REDHAT-BUG-1144994?

Currently, there is no specific patch mentioned for REDHAT-BUG-1144994; remedy the vulnerability by adjusting the web origin settings as recommended.