CVE-2024-4028

Published: Feb 18, 2025Modified: Jun 17, 2026Deferred

3.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.2 / Impact: 2.5

Source: secalert@redhat.com (Secondary)

Description

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://access.redhat.com/security/cve/CVE-2024-4028

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2276418

Source: secalert@redhat.com

Timeline

No history available yet.