Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2022-34212 Vulnerability in maven package org.jenkins-ci.plugins:vmware-vrealize-orchestrator
CVE-2022-43432 Vulnerability in maven package org.jenkins-ci.plugins:xframium
CVE-2022-3143 Vulnerability in maven package org.wildfly.security:wildfly-elytron-credential
CVE-2022-36076 Vulnerability in npm package nodebb
CVE-2023-39154 Vulnerability in maven package com.qualys.plugins:qualys-was