-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of UMA policy scripts during policy creation. The HTTP response handler (HttpMethodResponseHandler) and policy resource controller (PolicyResource) are core components responsible for processing policy configurations. Since the advisory specifically mentions UMA policy script injection, these functions would be the logical points where untrusted script input was accepted without proper validation. The high confidence comes from the vulnerability's description matching the typical responsibility areas of these classes in the keycloak-authz-client module.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-authz-client | maven | < 8.0.0 | 8.0.0 |