GHSA-8vf3-4w62-m3pq

ghsaUSosv

XSS in Keycloak

view advisory published 2020-04-15Licence: CC-BY-4.0

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1697US	medium5.4	0.76% (55th)	—	2020-02-10
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XS…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1697ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan