Moderate severityNVD Advisory· Published Apr 6, 2020· Updated Aug 4, 2024
CVE-2020-1728
CVE-2020-1728
Description
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-coreMaven | <= 9.0.3 | — |
Affected products
2- Keycloak/Keycloakdescription
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-3gg7-9q2x-79fcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-1728ghsaADVISORY
- bugzilla.redhat.com/show_bug.cgighsax_refsource_CONFIRMWEB
- issues.redhat.com/browse/KEYCLOAK-12264ghsaWEB
News mentions
0No linked articles in our index yet.