CVE-2022-4137 — HIGH (8.1) — White Hats Nepal

Vulnerability Description

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Keycloak	-
Redhat	Single Sign-On	7.6
Redhat	Enterprise Linux	7.0

Related Weaknesses (CWE)

CWE-81 CWE-79

References

https://access.redhat.com/errata/RHSA-2023:1043Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1044Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1045Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1049Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-4137Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2148496Issue TrackingVendor Advisory
https://access.redhat.com/errata/RHSA-2023:1043Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1044Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1045Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1049Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-4137Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2148496Issue TrackingVendor Advisory

FAQ

What is CVE-2022-4137?

CVE-2022-4137 is a vulnerability with a CVSS score of 8.1 (HIGH). A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Key...

How severe is CVE-2022-4137?

CVE-2022-4137 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-4137?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Keycloak, Redhat Single Sign-On, Redhat Enterprise Linux.