1. Home
  2. Vulnerabilities
  3. CVE-2022-4361

CVE-2022-4361

CVSS v3.1 6.1 (Medium)
61% Progress
EPSS 0.05 % (22th)
0.05% Progress
Affected Products 6
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

Weaknesses
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-81
Improper Neutralization of Script in an Error Message Web Page
CVE Status
PUBLISHED
CNA
Red Hat, Inc.
Published Date
2023-07-07 20:15:09
(14 months ago)
Updated Date
2023-07-17 17:50:07
(14 months ago)

Affected Products

Redhat

Configuration #1

AND
    CPE23 From Up To
OR  
  Redhat Keycloak prior 21.1.2 version cpe:2.3:a:redhat:keycloak < 21.1.2

Configuration #2

AND
    CPE23 From Up To
OR  
  Redhat Single Sign-on from 7.6 version and prior 7.6.4 version cpe:2.3:a:redhat:single_sign-on >= 7.6 < 7.6.4
OR  
  Running on/with
  Redhat Enterprise Linux 7.0 cpe:2.3:o:redhat:enterprise_linux:7.0
OR  
  Running on/with
  Redhat Enterprise Linux 8.0 cpe:2.3:o:redhat:enterprise_linux:8.0
OR  
  Running on/with
  Redhat Enterprise Linux 9.0 cpe:2.3:o:redhat:enterprise_linux:9.0

Configuration #3

AND
    CPE23 From Up To
OR  
  Redhat Single Sign-on cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only

Configuration #4

AND
    CPE23 From Up To
OR  
  Redhat Openshift Container Platform 4.11 cpe:2.3:a:redhat:openshift_container_platform:4.11
OR  
  Running on/with
  Redhat Openshift Container Platform 4.12 cpe:2.3:a:redhat:openshift_container_platform:4.12
OR  
  Running on/with
  Redhat Openshift Container Platform for Ibm Linuxone 4.9 cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9
OR  
  Running on/with
  Redhat Openshift Container Platform for Ibm Linuxone 4.10 cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10
OR  
  Running on/with
  Redhat Openshift Container Platform for Power 4.9 cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9
OR  
  Running on/with
  Redhat Openshift Container Platform for Power 4.10 cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10
OR  
  Running on/with
  Redhat Enterprise Linux 8.0 cpe:2.3:o:redhat:enterprise_linux:8.0