CVE-2022-2256
Fixed in a distro release EPSS <1%
A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.
Products: redhat single_sign-on
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-parent | 19.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.8-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.8-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.8-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.8-1.redhat_00001.1.el8sso |