Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-12160US | high7.2 | — | ||
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the ca… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2017:2904WEB
- https://access.redhat.com/errata/RHSA-2017:2905WEB
- https://access.redhat.com/errata/RHSA-2017:2906WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1484154WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2017-12160ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan