CVE-2021-20195 log

Severity High
Remote Yes
Type Cross-site scripting
A security issue was found in keycloak before version 12.0.3. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak.
Group Package Affected Fixed Severity Status Ticket
AVG-1578 keycloak 12.0.2-1 12.0.3-1 High Fixed
Date Advisory Group Package Severity Type
20 Feb 2021 ASA-202102-29 AVG-1578 keycloak High cross-site scripting