CVE-2018-14655

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Red Hat	keycloak	3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final

References

https://access.redhat.com/errata/RHSA-2018:3592Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3592Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655Issue Tracking, Vendor Advisory

Timeline

Published: Nov 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146565.5A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrar CVE-2018-146578.1A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm CVE-2018-146586.1A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.CVE-2018-146596.5The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_K CVE-2018-14665.3IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, CVE-2018-146606.5A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, auth CVE-2018-146616.5It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage,CVE-2018-146625.7It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used CVE-2018-146635.9An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the ad CVE-2018-146645.4A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in CVE-2018-146656.6A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X CVE-2018-146667.2An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host r