CVE-2020-1727 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-1727 PUBLISHED CVSS 6.4 MEDIUM

Reported by redhat · Published June 22, 2020

A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients.

Risk Scores

CVSS v3.1

6.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
[UNKNOWN]	keycloak	Versions before 9.0.2
[UNKNOWN]	keycloak	Versions before 9.0.2, Versions before 9.0.2
Maven	org.keycloak:keycloak-services	0, 0

Timeline

Jun 22, 2020 CVE Published
Jun 29, 2020 CVE Updated
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score

References

x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2020-1727 advisory

Open in Interactive Console →