6.6
Medium
CVE-2019-10170 A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via…
Description
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak | 8.0.0 | No fix stated |
Other CVEs of keycloak
The 6 CVEs of keycloak →
CVE-2020-1727
A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks…
6.4
Medium
CVE-2019-10169
A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy
6.6
Medium
CVE-2020-1728
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application…
4.8
Medium
CVE-2018-14637
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML…
6.1
Medium