Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52136?format=api",
    "vulnerability_id": "VCID-nr8h-9hfg-8bhr",
    "summary": "Duplicate Advisory: Keycloak vulnerable to Cross-Site Scripting (XSS)\n## Duplicate Advisory\nThis advisory is a duplicate of [GHSA-w9mf-83w3-fv49](https://github.com/advisories/GHSA-w9mf-83w3-fv49). This link is maintained to preserve external references.\n\n## Original Description\nA stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.",
    "aliases": [
        {
            "alias": "GHSA-w8v7-c7pm-7wfr"
        }
    ],
    "fixed_packages": [],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/144355?format=api",
            "purl": "pkg:maven/org.keycloak/keycloak-core@19.0.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-2xyb-g3n4-n3ca"
                },
                {
                    "vulnerability": "VCID-49qw-j7rn-qfdf"
                },
                {
                    "vulnerability": "VCID-7j7q-m1zp-zfac"
                },
                {
                    "vulnerability": "VCID-7xuf-btg3-ckf6"
                },
                {
                    "vulnerability": "VCID-c8ps-95au-zbg5"
                },
                {
                    "vulnerability": "VCID-dxj3-8sk5-mfdy"
                },
                {
                    "vulnerability": "VCID-e85z-cn66-fye8"
                },
                {
                    "vulnerability": "VCID-eaaa-ejr9-6ygx"
                },
                {
                    "vulnerability": "VCID-engr-q4ge-53dc"
                },
                {
                    "vulnerability": "VCID-epys-8p8v-zugv"
                },
                {
                    "vulnerability": "VCID-epz8-5t8d-v7b5"
                },
                {
                    "vulnerability": "VCID-heqp-u355-wyaz"
                },
                {
                    "vulnerability": "VCID-kp25-fan9-jkd2"
                },
                {
                    "vulnerability": "VCID-nhe2-8dtq-gqbf"
                },
                {
                    "vulnerability": "VCID-nr8h-9hfg-8bhr"
                },
                {
                    "vulnerability": "VCID-yaxc-7za7-zbbe"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-core@19.0.1"
        }
    ],
    "references": [
        {
            "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.4",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2101942"
        },
        {
            "reference_url": "https://github.com/keycloak/keycloak",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.4",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/keycloak/keycloak"
        },
        {
            "reference_url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.4",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.4",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2256"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-w8v7-c7pm-7wfr",
            "reference_id": "GHSA-w8v7-c7pm-7wfr",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "cvssv3.1_qr",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/advisories/GHSA-w8v7-c7pm-7wfr"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 79,
            "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
            "description": "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."
        }
    ],
    "exploits": [],
    "severity_range_score": "4.0 - 6.9",
    "exploitability": "0.5",
    "weighted_severity": "6.2",
    "risk_score": 3.1,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nr8h-9hfg-8bhr"
}