CVE-2022-1274

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

Score

CVSS 3.1 5.4 Medium

Status

Modified - secalert@redhat.com

Published

2023-03-29

Last modified

2024-08-02

Weaknesses

CWE-79, CWE-80

Affected products

• Keycloak (Redhat)
• Openshift Container Platform (Redhat)
• Single Sign-on (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2073157
• https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
• https://herolab.usd.de/security-advisories/usd-2021-0033/