CVE-2022-1438 MEDIUM

CVE-2022-1438: Keycloak: xss on impersonation under specific circumstances

Vendor Red Hat

Product Red Hat Single Sign-On 7

Weakness CWE-79 · XSS

Published September 20, 2023

Last update September 24, 2024

View on NVD All CVEs

CVSS base score

6.4/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.

Key dates

02Disclosure timeline

September 20, 2023 CVE published

September 24, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1438 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-47022 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) CVE-2025-9222 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab CVE-2022-1430 Cross-site Scripting (XSS) - DOM in octoprint/octoprint CVE-2024-33645 WordPress Easy Set Favicon plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-0963 Unrestricted XML Files Leads to Stored XSS in microweber/microweber