Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2022-36272 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2022-22979 Vulnerability in maven package org.springframework.cloud:spring-cloud-function-parent
CVE-2020-13654 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2023-2632 Vulnerability in maven package org.jenkins-ci.plugins:codedx
CVE-2022-40150 Vulnerability in maven package org.codehaus.jettison:jettison