CVE-2022-1438: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability (CVE-2022-1438) was discovered in Keycloak, where HTML entities are not properly sanitized during user impersonation under specific circumstances. The vulnerability affects Red Hat Single Sign-On 7.6, which is based on the Keycloak project (NVD, Red Hat Advisory).

The vulnerability exists in the authentication processor code where exception handling fails to properly sanitize HTML entities during user impersonation. The issue has a CVSS v3.1 base score of 4.8 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N according to NVD assessment (NVD).

If exploited, this vulnerability could allow an attacker to execute malicious JavaScript code in the context of other users' sessions when they attempt to impersonate users. This could potentially lead to unauthorized access to sensitive information or perform actions on behalf of other users (Red Hat Advisory).

The vulnerability has been fixed in Red Hat Single Sign-On 7.6.2 for various platforms including RHEL 7, 8, and 9. Users are advised to upgrade to the latest version to address this security issue (Red Hat Advisory).