CVE-2022-1274

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type

GIT

Repo

https://github.com/keycloak/keycloak

Events

Introduced

Fixed

57eda39e3cd2feef3749a071909ab5a88ab242c3

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "20.0.5"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1274.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "7.6"
            },
            {
                "fixed": "7.6.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.9"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.10"
            }
        ]
    }
]