CRITICAL🇵🇱 Wersja polska

CVE-2021-20195

CVSS 9.6v3.1pub. 2021-05-28upd. 2024-11-21

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Red Hat Keycloak

    APP
    Redhat
    < 12.0.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2022-4361CRITICAL10.0PL ✓same product

XSS w Keycloak — podatność w obsłudze SAML/OIDC umożliwia wykonanie złośliwych skryptów

CVE-2022-3782CRITICAL9.1PL ✓same product

Keycloak: path traversal przez podwójne kodowanie URL w przekierowaniach

CVE-2022-1245CRITICAL9.8PL ✓same product

Privilege escalation w mechanizmie token exchange w Keycloak

CVE-2019-14837CRITICAL9.1PL ✓same product

Keycloak: przejęcie konta przez domenę placeholder.org przed wersją 8.0.0

CVE-2019-14910CRITICAL9.8PL ✓same product

Red Hat Keycloak — pominięcie uwierzytelnienia LDAP przy użyciu StartTLS