CVE-2022-0225 | Vulnetix

CVE-2022-0225 PUBLISHED CVSS 5.400000095367432 MEDIUM

Reported by redhat · Published August 26, 2022

A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
keycloak	dhi.docker.com	20.0.0

Risk scores

CVSS 3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
n/a	keycloak	Not-Known
n/a	keycloak	*
Maven	org.keycloak:keycloak-core	0

Timeline

Aug 26, 2022 CVE Published
Aug 27, 2022 EPSS Score (30 in total, the first dated here)
Jun 1, 2026 Security Advisory
Jul 13, 2026 Coalition ESS Score
Aug 11, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2022-0225
vulnetix vdb fixes CVE-2022-0225

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-0225/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

x_refsource_MISC
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2022-0225 advisory
https://github.com/advisories/GHSA-fqc7-5xxc-ph7r advisory

Look up in the Resolve Platform →