CVE-2018-14655
Fixed in a distro release EPSS 1%CVSS 4.6
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Products: Red Hat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-parent | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |