CVE-2021-20222

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-79

Affected software

Vendor	Product	Versions
n/a	keycloak	keycloak 13.0.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1924606Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1924606Issue Tracking, Vendor Advisory

Timeline

Published: Mar 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202245.5An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to Ge CVE-2021-202256.7A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer b CVE-2021-202267.8A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of servic CVE-2021-202275.5A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries l CVE-2021-202287.5A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when CVE-2021-202294.3A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query CVE-2021-20234.7Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12 CVE-2021-202307.5A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and ve CVE-2021-202319.8A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequence CVE-2021-202329.8A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other CVE-2021-202338.2A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assum CVE-2021-202346.5An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue