GHSA-959q-32g8-vvp7

ghsaUSosv

Moderate severity vulnerability that affects org.keycloak:keycloak-core

view advisory published 2018-10-18Licence: CC-BY-4.0

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-12161US	high8.8	1.31% (70th)	—	2018-02-21
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to c…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1484564WEB
https://github.com/advisories/GHSA-959q-32g8-vvp7ADVISORY
https://github.com/keycloak/keycloak-documentation/pull/268/commits/a2b58aadee42af2c375b72e86dffc2cf23cc3770WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-12161ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan