CVE-2018-14655 - OpenCVE

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Redhat	Linux Keycloak Single Sign-on

Configuration 1 [-]

OR	cpe:2.3:a:redhat:keycloak:3.4.3:::::::*
	cpe:2.3:a:redhat:keycloak:4.0.0:beta2::::::
	cpe:2.3:a:redhat:keycloak:4.3.0:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*

Configuration 4 [-]

cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

References

Link	Resource
https://access.redhat.com/errata/RHSA-2018:3592	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655	Issue Tracking Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: redhat

Published: 2018-11-13T19:00:00

Updated: 2018-11-14T10:57:02

Reserved: 2018-07-27T00:00:00

Link: CVE-2018-14655

JSON object: View

NVD Information

Status : Modified

Published: 2018-11-13T19:29:00.307

Modified: 2019-10-09T23:35:07.390

Link: CVE-2018-14655

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:keycloak:3.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "3D602684-69EC-4051-AF5B-02595A16BEBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:keycloak:4.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "91B84EB8-4384-4638-9033-914B0F378D46", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:keycloak:4.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "45BFBB51-AC74-453F-B24D-2BB1E04BD410", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*", "matchCriteriaId": "FABBE0BB-135A-458C-BD84-54C052FFDC57", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "29B186E5-7C2F-466E-AA4A-8F2B618F8A14", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*", "matchCriteriaId": "FABBE0BB-135A-458C-BD84-54C052FFDC57", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2DFA94D5-0139-490C-8257-0751FE9FBAE4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*", "matchCriteriaId": "341E6313-20D5-44CB-9719-B20585DC5AD6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login."}, {"lang": "es", "value": "Se ha descubierto un error en Keycloak 3.4.3.Final, 4.0.0.Beta2 y 4.3.0.Final. Al emplear \"response_mode=form_post\", es posible inyectar c\u00f3digo JavaScript arbitrario mediante el par\u00e1metro \"state\" en la URL de autenticaci\u00f3n. Esto permite un ataque Cross-Site Scripting (XSS) al iniciar sesi\u00f3n exitosamente."}], "id": "CVE-2018-14655", "lastModified": "2019-10-09T23:35:07.390", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2018-11-13T19:29:00.307", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3592"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3593"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3595"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "secalert@redhat.com", "type": "Secondary"}]}