GHSA-px42-mr8m-cpghMediumCVSS 6.1

JBoss KeyCloak Cross-site Scripting Vulnerability

Published
May 17, 2022
Last Modified
August 16, 2023

🔗 CVE IDs covered (1)

CVE-2014-3656 →

📋 Description

If a JBoss Keycloak application was configured to use * as a permitted web origin in the Keycloak administrative console, crafted requests to the login-status-iframe.html endpoint could inject arbitrary Javascript into the generated HTML code via the "origin" query parameter, leading to a cross-site scripting (XSS) vulnerability.

🎯 Affected products1

  • maven/org.keycloak:keycloak-core:< 1.1.0.Beta1

🔗 References (7)