Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2021-46365 Vulnerability in maven package info.magnolia:magnolia-core
CVE-2021-23445 Vulnerability in npm package datatables.net
CVE-2022-39299 Vulnerability in npm package node-saml
CVE-2016-3737 Vulnerability in maven package org.rhq:rhq-enterprise-comm
CVE-2022-28355 Vulnerability in maven package org.scala-js:scalajs-library_2.12