Keycloak CSRF Vulnerability
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-12159US | high7.5 | — | ||
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, l… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2017:2904WEB
- https://access.redhat.com/errata/RHSA-2017:2905WEB
- https://access.redhat.com/errata/RHSA-2017:2906WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1484111WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-12159ADVISORY
- https://web.archive.org/web/20210124113906/http://www.securityfocus.com/bid/101601WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan