GHSA-95m6-mjh3-58gm

ghsaUSosv

Improper Authentication in org.keycloak:keycloak-core

view advisory published 2018-10-18Licence: CC-BY-4.0

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-8609US	high8.1	1.68% (77th)	—	2018-08-01
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-95m6-mjh3-58gmADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2016-8609ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan