CVE-2018-14655 MEDIUM

CVE-2018-14655

Vendor Red Hat
Product keycloak
Weakness CWE-79 · XSS
Published November 13, 2018
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

Key dates

02Disclosure timeline

November 13, 2018 CVE published
August 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-33946 WordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-4871 Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute CVE-2024-1282 Email Encoder – Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-38703 WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability CVE-2026-24392 WordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerability