Executive brief
Cross-site Scripting in keycloak
Affected products
- Maven org.keycloak:keycloak-server-spi-private
- Maven org.keycloak:keycloak-services
Junglewise Threat Intelligence
CVE-2020-10776: Cross-site Scripting in keycloak
CVE-2020-10776 · Severity: low · CVSS 3.1 · Published 2022-02-09
Technologies: org.keycloak:keycloak-server-spi-private (Maven), org.keycloak:keycloak-services (Maven). Vendors: Maven.
Related threats
- Keycloak information disclosure via user profile permission bypass in group members endpoint
- Keycloak privilege escalation in Fine-Grained Admin Permissions scope mapping
- Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement
- Keycloak privilege escalation in Fine-Grained Admin Permissions
- Keycloak signature policy bypass in JWE-encrypted request objects