Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2023-44402 Vulnerability in npm package electron
CVE-2021-42550 Vulnerability in maven package ch.qos.logback:logback-core
CVE-2022-31069 Vulnerability in npm package @finastra/nestjs-proxy
CVE-2023-29509 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-theme-ui
CVE-2021-27290 Vulnerability in maven package org.webjars.npm:ssri