-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 21.1.2 | 21.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of URI schemes in redirect handling. The commit patching CVE-2022-4361 adds explicit scheme checks in verifyRedirectUri() and modifies matchesRedirects() to return matched patterns. The pre-patch version of verifyRedirectUri() lacked critical validation: it normalized URIs without verifying if non-HTTP(S) schemes were explicitly allowed, enabling XSS via crafted 'javascript:' URIs when clients used permissive wildcard patterns. The matchesRedirects() function contributed by allowing generic '*' patterns to match non-HTTP schemes unless explicitly restricted. The test cases added in the commit (e.g., testing 'javascript:alert("XSS")' rejection) confirm this attack vector.
Ongoing coverage of React2Shell