CVE-2024-4028
Fixed in a distro release EPSS <1%CVSS 3.8
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.
Products: Red Hat Build of Keycloak, Red Hat Single Sign-On 7
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak | 26.1.3-r0 |
| Chainguard | keycloak-bitnami-compat | 26.1.3-r0 |
| Chainguard | keycloak-bitnami-fips | 26.1.3-r0 |
| Chainguard | keycloak-compat | 26.1.3-r0 |
| Chainguard | keycloak-config-cli | 6.4.0-r1 |
| Chainguard | keycloak-config-cli-bitnami-compat | 6.4.0-r1 |
| Chainguard | keycloak-config-cli-compat | 6.4.0-r1 |
| Chainguard | keycloak-config-cli-iamguarded-compat | 6.4.0-r1 |
| Chainguard | keycloak-fips | 26.1.3-r0 |
| Chainguard | keycloak-fips-bitnami-compat | 26.1.3-r0 |
| Chainguard | keycloak-fips-policy-140-2 | 26.1.3-r0 |
| Chainguard | keycloak-fips-policy-140-3 | 26.1.3-r0 |
| Chainguard | keycloak-iamguarded-compat | 26.1.3-r0 |
| Chainguard | keycloak-iamguarded-fips | 26.1.3-r0 |
| Chainguard | keycloak-operator | 26.1.3-r0 |
| Chainguard | keycloak-operator-compat | 26.1.3-r0 |
| Wolfi | keycloak | 26.1.3-r0 |
| Wolfi | keycloak-bitnami-compat | 26.1.3-r0 |
| Wolfi | keycloak-compat | 26.1.3-r0 |
| Wolfi | keycloak-config-cli | 6.4.0-r1 |
| Wolfi | keycloak-config-cli-bitnami-compat | 6.4.0-r1 |
| Wolfi | keycloak-config-cli-compat | 6.4.0-r1 |
| Wolfi | keycloak-config-cli-iamguarded-compat | 6.4.0-r1 |
| Wolfi | keycloak-iamguarded-compat | 26.1.3-r0 |
| Wolfi | keycloak-operator | 26.1.3-r0 |
| Wolfi | keycloak-operator-compat | 26.1.3-r0 |