ASA-202102-29 log generated external raw

[ASA-202102-29] keycloak: cross-site scripting
Arch Linux Security Advisory ASA-202102-29 ========================================== Severity: High Date : 2021-02-20 CVE-ID : CVE-2021-20195 Package : keycloak Type : cross-site scripting Remote : Yes Link : Summary ======= The package keycloak before version 12.0.3-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 12.0.3-1. # pacman -Syu "keycloak>=12.0.3-1" The problem has been fixed upstream in version 12.0.3. Workaround ========== None. Description =========== A security issue was found in keycloak before version 12.0.3. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak. Impact ====== A malicious user can execute arbitrary code in Keycloak's account page possibly compromising Keycloak's admin account. References ==========