CVE-2020-1728 Improper Restriction of Rendered UI Layers or Frames in Keycloak

What is CVE-2020-1728?

CVE-2020-1728 is a medium-severity vulnerability in Redhat Keycloak, published on 6 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.

Weakness: CWE-1021, CWE-358

Which versions are affected by CVE-2020-1728?

2 open source packages ship an affected version, including org.keycloak:keycloak-core. It affects 2 products.

Products include Quarkus Quarkus, Redhat Keycloak.

How do I fix CVE-2020-1728?

Apply the vendor's patch.

Is CVE-2020-1728 being exploited?

There is no known exploitation of CVE-2020-1728 in the wild and no public exploit code.

Other vulnerabilities in Redhat Keycloak

• CVE-2022-4116 Code injection in quarkus dev ui config editor Critical 9.8
• CVE-2022-2466 Quarkus does not terminate HTTP requests header context Critical 9.8
• CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass Critical 9.1
• CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency High 8.8
• CVE-2022-0981 Privilege escalation in quarkus High 8.8

All Redhat Keycloak vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3gg7-9q2x-79fc.