Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-2256

UNKNOWN
Published 2022-09-01T19:57:29
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-2256. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

WordPress Vulnerability

Identified and analyzed by Wordfence

Software Type

Plugin

Patch Status

Patched

Published

July 5, 2022

Software Details

Software Name

Visualizer: Tables and Charts Manager for WordPress

Software Slug

visualizer

Affected Versions

* - 3.7.9

Patched Versions

3.7.10

Remediation

Update to version 3.7.10, or a newer patched version

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/d25ed357-2895-47c7-9418-628068c6d18e?source=api-prod

© Defiant Inc. Data provided by Wordfence.

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

GHSA-w9mf-83w3-fv49

Advisory Details

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (18.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality. ### CVSS 3.1 - **3.8** **Vector String:** AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N **Vector Clarification:** * User interaction is not required as the admin console is regularly used during an administrator's work * The scope is unchanged since the admin console web application is both the vulnerable component and where the exploit executes ### Credits Aytaç Kalıncı, Ilker Bulgurcu, Yasin Yılmaz (@aytackalinci, @smileronin, @yasinyilmaz) - NETAŞ PENTEST TEAM

Affected Packages

Maven org.keycloak:keycloak-parent
ECOSYSTEM: ≥0 <19.0.2

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

WEB https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-2256
WEB https://github.com/keycloak/keycloak/commit/8e705a65ab2aa2b079374ec859ee7a75fad5a7d9
WEB https://bugzilla.redhat.com/show_bug.cgi?id=2101942
PACKAGE https://github.com/keycloak/keycloak

Advisory provided by GitHub Security Advisory Database. Published: September 23, 2022, Modified: October 18, 2022

References

https://bugzilla.redhat.com/show_bug.cgi?id=2101942
https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
Published: 2022-09-01T19:57:29
Last Modified: 2024-08-03T00:32:09.302Z
Copied to clipboard!