CVE-2021-20222: Code injection in keycloak
Summary
CVE-2021-20222: Code injection in keycloak. Affects org.keycloak:keycloak-parent versions >= 9.0.0, < 12.0.3. Fixed in 12.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, social login, and user federation. The keycloak-parent package is a Maven project that serves as the parent for other Keycloak modules. It is an essential component of the Keycloak ecosystem.
Vulnerability Detail
A flaw has been discovered in keycloak that allows for code injection. The vulnerability exists in the new account console, where malicious code can be executed using the referrer URL. This can lead to a compromise of data confidentiality and integrity, as well as system availability. The vulnerability has a CVSS score of 8.3, indicating a high severity level.
How To Fix
Minimum fixed version
12.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the keycloak-parent package to the latest version.
Conclusion
The code injection vulnerability in keycloak can have severe consequences for data and system security. It is crucial to update the keycloak-parent package to the fixed version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Keycloak is an open-source identity and access management solution that provides security features for applications and services.
The keycloak-parent package is a Maven project that serves as the parent for other Keycloak modules. It is an essential component of the Keycloak ecosystem.
This vulnerability allows for code injection in the keycloak new account console, which can lead to data confidentiality and integrity breaches, as well as system availability issues.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
To fix this vulnerability, update the keycloak-parent package to version 12.0.3 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
