VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Sep 1, 2022· Updated Aug 3, 2024

CVE-2022-2256

CVE-2022-2256

Description

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-parentMaven
< 19.0.219.0.2

Affected products

1
  • N/a/Keycloakv5
    Range: keycloak as shipped in Red Hat Single Sign-On 7

Patches

1
8e705a65ab2a

Merge pull request from GHSA-w9mf-83w3-fv49 (#14271)

https://github.com/keycloak/keycloakStian ThorgersenSep 8, 2022via ghsa
commit
1 file changed · +3 −7
  • themes/src/main/resources/theme/base/admin/resources/js/services.js+3 −7 modified
    @@ -957,15 +957,11 @@ function clientSelectControl($scope, realm, Client) {
         delay: 500,
         allowClear: true,
         query: function (query) {
-            var data = {results: []};
             Client.query({realm: realm, search: true, clientId: query.term.trim(), max: 20}, function(response) {
-                data.results = response;
-                query.callback(data);
+                query.callback({ results: response.map(function (client) {
+                    return { id: client.id, text: client.clientId }
+                });
             });
-        },
-        formatResult: function(object, container, query) {
-            object.text = object.clientId;
-            return object.clientId;
         }
     };
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.