[ASA-202102-29] keycloak: cross-site scripting
foxboron at archlinux.org
Thu Feb 25 08:42:59 UTC 2021
Arch Linux Security Advisory ASA-202102-29
Date : 2021-02-20
CVE-ID : CVE-2021-20195
Package : keycloak
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-1578
The package keycloak before version 12.0.3-1 is vulnerable to cross-
Upgrade to 12.0.3-1.
# pacman -Syu "keycloak>=12.0.3-1"
The problem has been fixed upstream in version 12.0.3.
A security issue was found in keycloak before version 12.0.3. A self
stored cross-site scripting (XSS) attack vector escalating to a
complete account takeover is possible due to user-supplied data fields
the data. Specifically, the Account page does not HTML-encode the user
first name, and last name, which means a malicious HTML code, which
attacker user (Self-XSS), it can be exploited on the Keycloak admin
browser, using the Impersonation functionality, and thus the attacker
is able to compromise Keycloak.
A malicious user can execute arbitrary code in Keycloak's account page
possibly compromising Keycloak's admin account.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security