GitHub Advisoryadvisory · Maven

GHSA-3gg7-9q2x-79fc Improper Restriction of Rendered UI Layers or Frames in Keycloak

MEDIUM Published 2020-04-15 Modified 2020-04-15 Official page ↗
Aliases
CVE-2020-1728
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
Weaknesses
CWE-1021
Reviewed
2020-04-15

Affected packages

• Maven org.keycloak:keycloak-core: <= 9.0.3 (no fix yet)

Description

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.

Related

Alias · CVE (1)

  • CVE-2020-1728 A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing… vulnerability

Weakness · CWE (1)

  • CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness

References