What is GHSA-3p62-6fjh-3p5h?

GHSA-3p62-6fjh-3p5h is a security advisory published by GitHub Security Advisories with Critical severity. Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

Which CVE IDs does GHSA-3p62-6fjh-3p5h cover?

GHSA-3p62-6fjh-3p5h covers the following CVE IDs: CVE-2022-4361. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3p62-6fjh-3p5h?

GHSA-3p62-6fjh-3p5h has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-3p62-6fjh-3p5h?

GHSA-3p62-6fjh-3p5h affects 1 product, including: maven/org.keycloak:keycloak-services:\u003c 21.1.2.

GHSA-3p62-6fjh-3p5hCriticalCVSS 10.0

Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

Vendor

GitHub Security Advisories

Published

June 30, 2023

Last Modified

November 6, 2023

🔗 CVE IDs covered (1)

CVE-2022-4361 →

📋 Description

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).

AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.

🎯 Affected products1

maven/org.keycloak:keycloak-services:< 21.1.2

🔗 References (5)

https://github.com/keycloak/keycloak/security/advisories/GHSA-3p62-6fjh-3p5h
https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a
https://nvd.nist.gov/vuln/detail/CVE-2022-4361
https://bugzilla.redhat.com/show_bug.cgi?id=2151618
https://github.com/advisories/GHSA-3p62-6fjh-3p5h