CVE-2022-2256

LOW

Red Hat Single Sign-On 7 - Stored Cross-Site Scripting in Admin Console via Default Roles

Title source: llm

Description

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=2101942

Broken Link, Third Party Advisory x_refsource_misc

https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49

Scores

CVSS v3 3.8

EPSS 0.0088

EPSS Percentile 75.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

org.keycloak/keycloak-parent 0 - 19.0.2Maven

redhat/single_sign-on 7.0

Published Sep 01, 2022

Tracked Since Feb 18, 2026