Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2017-5635 Vulnerability in maven package org.apache.nifi:nifi-web-security
CVE-2019-14893 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2022-22965 Vulnerability in maven package org.springframework.boot:spring-boot-starter-webflux
CVE-2019-10446 Vulnerability in maven package org.jenkins-ci.plugins:vmanager-plugin
CVE-2023-50777 Vulnerability in maven package com.cloudtp.jenkins:paaslane-estimate