{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"keycloak","vendor":"keycloak","versions":[{"status":"unaffected","version":"21.1.2"}]}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*","matchCriteriaId":"756CF1FB-9891-4069-BBDF-BA548F6C1F9C","versionEndExcluding":"21.1.2","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*","matchCriteriaId":"1C5D8D6E-F093-4A2E-B98C-C14E40140ABA","versionEndExcluding":"7.6.4","versionStartIncluding":"7.6","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*","matchCriteriaId":"341E6313-20D5-44CB-9719-B20585DC5AD6","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*","matchCriteriaId":"EA983F8C-3A06-450A-AEFF-9429DE9A3454","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*","matchCriteriaId":"40449571-22F8-44FA-B57B-B43F71AB25E2","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:*:*:*:*:*:*:*","matchCriteriaId":"8C519B1A-1CD6-426C-9339-F28E4FEF581B","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:*","matchCriteriaId":"91EE3858-A648-44B4-B282-8F808D88D3B9","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*","matchCriteriaId":"30E2CF79-2D56-48AB-952E-5DDAFE471073","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*","matchCriteriaId":"54E24055-813B-4E6D-94B7-FAD5F78B8537","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri."}],"id":"CVE-2022-4361","lastModified":"2026-06-17T05:20:41.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-4361","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-11-12T19:43:33.065184Z","version":"2.0.3"}}]},"published":"2023-07-07T20:15:09.813","references":[{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2151618"},{"source":"secalert@redhat.com","tags":["Patch"],"url":"https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2151618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-81"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}