CVE-2022-2256

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

Published: Sep 1, 2022
Updated: May 9, 2024
CVE: CVE-2022-2256
GHSA: GHSA-w9mf-83w3-fv49
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 3.8
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
redhat / single_sign-on	7.0	7.0.x
org.keycloak / keycloak-parent	-	19.0.2

https://bugzilla.redhat.com/show_bug.cgi?id=2101942
https://github.com/keycloak/keycloak/commit/8e705a65ab2aa2b079374ec859ee7a75fad5a7d9
https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49

Vulnerability Database

CVE-2022-2256

Deep Security Visibility Without the Complexity