What is GHSA-wf7g-7h6h-678v?

GHSA-wf7g-7h6h-678v is a security advisory published by GitHub Security Advisories with High severity. Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

Which CVE IDs does GHSA-wf7g-7h6h-678v cover?

GHSA-wf7g-7h6h-678v covers the following CVE IDs: CVE-2022-2668. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wf7g-7h6h-678v?

GHSA-wf7g-7h6h-678v has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-wf7g-7h6h-678v?

GHSA-wf7g-7h6h-678v affects 1 product, including: maven/org.keycloak:keycloak-parent:\u003c 19.0.2.

GHSA-wf7g-7h6h-678vHighCVSS 7.2

Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

Vendor

GitHub Security Advisories

Published

September 23, 2022

Last Modified

January 8, 2023

🔗 CVE IDs covered (1)

CVE-2022-2668 →

📋 Description

An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

🎯 Affected products1

maven/org.keycloak:keycloak-parent:< 19.0.2

🔗 References (6)

https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v
https://nvd.nist.gov/vuln/detail/CVE-2022-2668
https://github.com/keycloak/keycloak/commit/e2ae7eef39b27e48ffa4764995d558555f02838c
https://access.redhat.com/security/cve/CVE-2022-2668
https://bugzilla.redhat.com/show_bug.cgi?id=2115392
https://github.com/advisories/GHSA-wf7g-7h6h-678v