In short
- CVE-2017-12160 is a HIGH (CVSS 7.2) vulnerability affecting org.keycloak:keycloak-parent.
- Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.9% of all vulnerabilities.
- Fix: update to 3.3.0.Final or later.
Description
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
NVD description
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
More vulnerabilities in org.keycloak:keycloak-parent
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free