CVE-2024-4028 - Keycloak-core: stored xss in keycloak when creating a items in admin console

Back Back to CVE browser

LOW

Keycloak-core: stored xss in keycloak when creating a items in admin console

Published Feb 18, 2025

3.8

LOW

CVSS 3.1

EPSS 0.30%

Description

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.

Affected products

Vendor Red Hat Product Red Hat Single Sign-On 7 Default
affected

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat Single Sign-On 7	affected

Red Hat Build of Keycloak

keycloak-core

Not affected
Red Hat Single Sign-On 7

rh-sso7-keycloak

Fix deferred

Product	Package	State	Advisory
Red Hat Build of Keycloak	keycloak-core	Not affected	n/a
Red Hat Single Sign-On 7	rh-sso7-keycloak	Fix deferred	n/a

Remediation

Vendor solution

Currently the is no mitigation available for this vulnerability.

Red Hat statement

Red Hat rates this as a Low impact since this requires previous high privileged administrator account to perform this operation.

Red Hat mitigation

Currently the is no mitigation available for this vulnerability.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-79

Cross-site Scripting (XSS)

References (6)

https://access.redhat.com/security/cve/CVE-2024-4028
vdb-entryx_refsource_REDHATVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2276418
issue-trackingx_refsource_REDHATIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32594
Advisory
https://github.com/advisories/GHSA-q4xq-445g-g6ch
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4028
https://www.cve.org/CVERecord?id=CVE-2024-4028

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-4028		vdb-entryx_refsource_REDHATVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2276418		issue-trackingx_refsource_REDHATIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32594		Advisory
https://github.com/advisories/GHSA-q4xq-445g-g6ch		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4028
https://www.cve.org/CVERecord?id=CVE-2024-4028