CVE-2022-2256

Опубликовано: 01 сент. 2022

Источник: nvd

CVSS3: 3.8

EPSS Низкий

Описание

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=2101942
Issue Tracking
Vendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
Broken Link
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2101942
Issue Tracking
Vendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
Broken Link
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00677

Низкий

3.8 Low

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2022-2256

CVSS3: 3.8

redhat

около 4 лет назад

CVE-2022-2256

CVSS3: 3.8

debian

около 4 лет назад

A Stored Cross-site scripting (XSS) vulnerability was found in keycloa ...

GHSA-w9mf-83w3-fv49

CVSS3: 5.4

github

почти 4 года назад

Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

EPSS

Процентиль: 50%

0.00677

Низкий

3.8 Low

CVSS3

Дефекты

CWE-79