CVE-2020-1697CWE-79

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and…

Medium · published February 10, 2020

CVSS v3.1
6.1
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00758 · 54.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-02-10T14:13Z
EPSS history
Timeline
  • 10 FEB 14:13Z
    It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and…
    cvelistv5