Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2020-10721 Vulnerability in maven package io.fabric8:fabric8-maven-plugin-core
CVE-2023-31103 Vulnerability in maven package org.apache.inlong:manager-pojo
CVE-2023-47324 Vulnerability in maven package org.silverpeas.core:silverpeas-core-war
CVE-2021-3424 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-1454 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-common