CVE-2020-1697 — Cross-site Scripting in Redhat Keycloak

CWE-79 — Cross-site Scripting8 documents6 sources
Severity
5.4MEDIUMNVD
CNA6.1
EPSS
0.3%
top 48.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat KeycloakRED HAT KeycloakRedhat Single Sign-on
Timeline
PublishedFeb 10
Latest updateJul 2

Description

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDredhat/keycloak< 9.0.0
▶CVEListV5red_hat/keycloakAll versions before 9.0.0

🔴Vulnerability Details

3
OSV
XSS in Keycloak↗2020-04-15
▶
GHSA
XSS in Keycloak↗2020-04-15
▶
CVEList
CVE-2020-1697: It was found in all keycloak versions before 9↗2020-02-10
▶

📋Vendor Advisories

2
Red Hat
keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)↗2020-07-02
▶
Red Hat
keycloak: stored XSS in client settings via application links↗2020-02-05
▶

💬Community

2
Bugzilla
CVE-2020-10748 keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)↗2020-05-18
▶
Bugzilla
CVE-2020-1697 keycloak: stored XSS in client settings via application links↗2020-01-16
▶
CVE-2020-1697 — Cross-site Scripting in Redhat Keycloak | cvebase