{"id":"CVE-2020-10748","published":"2020-09-16T17:56:07Z","modified":"2024-08-04T11:14:14Z","title":"A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some…","vendor":null,"product":null,"tier":"tail","description":{"text":"A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00931,"percentile":0.60497,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836786","tags":["x_refsource_MISC"]}],"priority":{"score":12.1,"factors":[{"name":"EPSS percentile","points":12.1}]},"affectedVersions":[{"vendor":"n/a","product":"keycloak","versions":["keycloak 10.0.1"]}],"affected":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-parent","vulnerableRanges":["<10.0.2"],"patched":["10.0.2"],"from":["GHSA-hgpg-593r-hhvp"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1045","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-build-of-keycloak-22-cve-2020-10748","children":[{"from":"CVE-2020-10748","to":"CVE-2023-6134","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This flaw is the result of an incomplete fix for CVE-2020-10748.","from":"CVE.org","in":"CVE-2023-6134"}]}],"packageHistory":[{"cve":"CVE-2020-1718","published":"2020-05-12","fixed":"8.0.0","kev":false},{"cve":"CVE-2020-1694","published":"2020-09-16","fixed":"10.0.0","kev":false,"link":{"from":"CVE-2020-1694","to":"CVE-2020-10748","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-parent","fromFixed":"10.0.0","toFixed":"10.0.2","daysApart":0}]}},{"cve":"CVE-2020-1758","published":"2020-05-15","fixed":"10.0.0","kev":false},{"cve":"CVE-2020-10748","published":"2020-09-16","fixed":"10.0.2","kev":false},{"cve":"CVE-2020-10758","published":"2020-09-16","fixed":"11.0.1","kev":false},{"cve":"CVE-2020-14366","published":"2020-11-09","fixed":"12.0.0","kev":false},{"cve":"CVE-2021-20222","published":"2021-03-23","fixed":"12.0.3","kev":false}],"package":"Maven:org.keycloak:keycloak-parent"}}