CVE-2020-1697

Published: Feb 10, 2020Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

Affected (2)

Products: Redhat: Keycloak, Single Sign On

2 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Keycloak	Before 9.0.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Single Sign On	Version 7.3

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.