GitHub Advisoryadvisory · Maven

GHSA-8vf3-4w62-m3pq XSS in Keycloak

MEDIUM Published 2020-04-15 Modified 2021-08-23 Official page ↗
Aliases
CVE-2020-1697
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-04-15

Affected packages

• Maven org.keycloak:keycloak-core: < 9.0.0 → fixed in 9.0.0

Description

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

Related

Alias · CVE (1)

  • CVE-2020-1697 It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References