En bref
- CVE-2017-12159 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.keycloak:keycloak-parent, single sign on (redhat).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.7%, plus élevée que 86.0% des vulnérabilités.
- Correctif : mettre à jour vers 3.4.0 ou plus récent.
Description
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
NVD description
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Autres vulnérabilités de org.keycloak:keycloak-parent
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free