Description

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=2073157

https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725

https://herolab.usd.de/security-advisories/usd-2021-0033/

Related Vulnerabilities

CVE-2022-22965 Vulnerability in maven package org.springframework:spring-webmvc

CVE-2023-40185 Vulnerability in npm package shescape

CVE-2022-4565 Vulnerability in maven package cn.hutool:hutool-core

CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-hive

CVE-2023-48240 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-default

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Vendor Advisory Third Party Advisory