Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Red Hat keycloak — RHSA-2017:2905 Clear all filters
TI-2017-08951 CVE-2017-12160 · GHSA-qc72-gfvw-76h7

Improper authorization in Red Hat keycloak

Priority LOW 35

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01924 Published 2017-10-26 Partial fix · 3.3.0.Final CWE-285
TI-2017-08950 CVE-2017-12159 · GHSA-7fmw-85qm-h22p

Insufficient session expiration in Red Hat keycloak

Priority LOW 38

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02711 Published 2017-10-26 Fixed in 3.4.0 CWE-613
TI-2017-08949 CVE-2017-12158 · GHSA-v38p-mqq3-m6v5

Cross-site scripting in Red Hat keycloak

Priority LOW 26

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01021 Published 2017-10-26 Partial fix · 3.4.0 CWE-444