Back to feed
EUVD-2023-1671 · Published Jun 30, 2023
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).
AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
Technologies
Redhat Openshift Container PlatformRedhat Enterprise LinuxRedhat Single Sign-OnRedhat Openshift Container Platform For PowerRedhat Openshift Container Platform For Ibm LinuxoneRedhat Keycloak
Weaknesses
CWE-81CWE-79
CVSS scores
- v3.110.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
