CVE-2018-14655: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 13, 2022 (updated October 19, 2023)

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using ‘response_mode=form_post’ it is possible to inject arbitrary Javascript-Code via the ‘state’-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

References

access.redhat.com/errata/RHSA-2018:3592
access.redhat.com/errata/RHSA-2018:3593
access.redhat.com/errata/RHSA-2018:3595
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655
github.com/advisories/GHSA-458h-wv48-fq75
nvd.nist.gov/vuln/detail/CVE-2018-14655

Code Behaviors & Features

Detect and mitigate CVE-2018-14655 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →