Описание
Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-wf7g-7h6h-678v. This link is maintained to preserve external references.
Original Description
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.
Пакеты
Наименование
org.keycloak:keycloak-saml-core
maven
Затронутые версииВерсия исправления
<= 19.0.1
Отсутствует
7.2 High
CVSS3
7.2 High
CVSS3