CVE-2020-10748 — Cross-site Scripting in Redhat Keycloak

CWE-79 — Cross-site ScriptingCWE-75 — Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)8 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 42.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Single Sign-onRedhat Keycloak
Timeline
PublishedSep 16
Latest updateDec 15

Description

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5redhat/keycloakkeycloak 10.0.1
▶NVDredhat/keycloak10.0.1

🔴Vulnerability Details

4
GHSA
Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri↗2023-12-15
▶
GHSA
Cross-site Scripting in Keycloak↗2022-02-09
▶
OSV
Cross-site Scripting in Keycloak↗2022-02-09
▶
CVEList
CVE-2020-10748: A flaw was found in Keycloak's data filter, in version 10↗2020-09-16
▶

📋Vendor Advisories

2
Red Hat
keycloak: reflected XSS via wildcard in OIDC redirect_uri↗2023-11-14
▶
Red Hat
keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)↗2020-07-02
▶

💬Community

1
Bugzilla
CVE-2020-10748 keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)↗2020-05-18
▶
CVE-2020-10748 — Cross-site Scripting in Redhat | cvebase