CVE-2022-4137: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

September 25, 2023 (updated November 7, 2023)

A reflected cross-site scripting (XSS) vulnerability was found in the ‘oob’ OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.

References

access.redhat.com/errata/RHSA-2023:1043
access.redhat.com/errata/RHSA-2023:1044
access.redhat.com/errata/RHSA-2023:1045
access.redhat.com/errata/RHSA-2023:1049
access.redhat.com/security/cve/CVE-2022-4137
bugzilla.redhat.com/show_bug.cgi?id=2148496
nvd.nist.gov/vuln/detail/CVE-2022-4137

Code Behaviors & Features

Detect and mitigate CVE-2022-4137 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →