CVE-2020-1697: XSS
First published: Thu Jan 16 2020(Updated: )
A flaw was found during the assessment of the Admin Console application for Keycloak, where it was found that Application Links to external applications are not validated properly. An attacker could use this flaw to cause Stored XSS attacks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/keycloak | <9.0.0 | 9.0.0 |
| Redhat Keycloak | <9.0.0 | |
| Redhat Single Sign-on | =7.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697
- https://issues.redhat.com/browse/KEYCLOAK-12459
- https://access.redhat.com/errata/RHSA-2020:2252
- https://access.redhat.com/security/cve/cve-2020-1697
- https://access.redhat.com/errata/RHSA-2020:2905
- https://bugzilla.redhat.com/show_bug.cgi?id=1791538
- https://www.cve.org/CVERecord?id=CVE-2020-1697 https://nvd.nist.gov/vuln/detail/CVE-2020-1697
- https://access.redhat.com/errata/RHSA-2020:0445
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2020-1697?
CVE-2020-1697 is a vulnerability found in all versions of Keycloak before 9.0.0 that allows for Stored XSS attacks through improperly validated links to external applications in the admin console.
What is the severity of CVE-2020-1697?
The severity of CVE-2020-1697 is medium, with a CVSSv3 base score of 6.1.
Which software versions are affected by CVE-2020-1697?
All versions of Keycloak before 9.0.0 are affected by CVE-2020-1697.
How can an attacker exploit CVE-2020-1697?
An authenticated malicious user can create URLs to trick users in other realms and potentially conduct further attacks by exploiting CVE-2020-1697.
What is the recommended solution for CVE-2020-1697?
The recommended solution is to update Keycloak to version 9.0.0 or later.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-1697
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/redhat
- canonical/redhat keycloak
- canonical/redhat single sign-on
- version/redhat single sign-on/7.3
- package-manager/redhat