Description
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=2073157
https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
https://herolab.usd.de/security-advisories/usd-2021-0033/
Related Vulnerabilities
CVE-2021-34801 Vulnerability in npm package valine
CVE-2022-39387 Vulnerability in maven package org.xwiki.contrib.oidc:oidc-authenticator
CVE-2022-0853 Vulnerability in maven package jboss:jboss-client
CVE-2022-29244 Vulnerability in npm package npm
CVE-2020-2276 Vulnerability in maven package org.jenkins-ci.plugins:selection-tasks-plugin