GHSA-q2gp-gph3-88x9 | Vulnetix

GHSA-q2gp-gph3-88x9 REJECTED CVSS 7.199999809265137 HIGH

Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled

Risk Scores

CVSS 3.1

7.199999809265137

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Maven	org.keycloak:keycloak-saml-core	0, 1.1.0.Beta1, 1.1.0.Beta2

Timeline

Jan 22, 2024 CVE Rejected
Jan 22, 2024 CVE Updated
Mar 2, 2026 Security Advisory

References

https://nvd.nist.gov/vuln/detail/CVE-2022-2668 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2115392 url
https://github.com/keycloak/keycloak product
GitHub Advisory GHSA-q2gp-gph3-88x9 vendor-advisory
https://access.redhat.com/security/cve/CVE-2022-2668 advisory

Open in Interactive Console →

$ Console Community · 100/wk Open console ›