Low WID-SEC-2025-0424 1 CVE

Keycloak: Schwachstelle ermöglicht Cross-Site Scripting

Published Feb 20, 2025 · Updated Apr 6, 2026 · Revision 2 · de-DE

Vendor: Hitachi Product: Ops Center Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Vulnerabilities 1

Low 3.8

CVE-2024-4028

Keycloak-core: stored xss in keycloak when creating a items in admin console

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.

Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak org.keycloak:keycloak-core Wolfi Maven

Feb 18, 2025

Revision history

2026-04-06 #2
Neue Updates von HITACHI aufgenommen
2025-02-20 #1
Initiale Fassung

References

GitHub Advisory Database vom 2025-02-20
https://github.com/advisories/GHSA-q4xq-445g-g6ch
Hitachi Vulnerability Information HITACHI-SEC-2026-117 vom 2026-04-07
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-117/index.html