Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2023-45857 Vulnerability in npm package axios
CVE-2022-36900 Vulnerability in maven package com.compuware.jenkins:compuware-zadviser-api
CVE-2023-25762 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-build-step
CVE-2021-32808 Vulnerability in maven package org.webjars.npm:ckeditor4
CVE-2022-45379 Vulnerability in maven package org.jenkins-ci.plugins:script-security