CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2018-14655
Medium (5.4) in redhat. EPSS 1.2% chance of exploitation in the next 30 days.
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:keycloak
- redhat:single_sign-on
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-458h-wv48-fq75 | Maven | org.keycloak:keycloak-parent | <=3.4.3.Final | no fix published |
| GHSA-458h-wv48-fq75 | Maven | org.keycloak:keycloak-parent | >=4.0.0.Beta1 <=4.0.0.Beta2 | no fix published |
| GHSA-458h-wv48-fq75 | Maven | org.keycloak:keycloak-parent | 4.3.0.Final | no fix published |