GHSA-p5xp-6vpf-jwvh

ghsaUSosv

Improper Input Validation and Cross-Site Request Forgery in Keycloak

view advisory published 2019-09-23Licence: CC-BY-4.0

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10199US	high8.8	0.50% (42nd)	—	2019-08-14
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user i…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10199WEB
https://github.com/keycloak/keycloakPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2019-10199ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan