Back to search
CVE-2017-12159
Published: Oct 26, 2017
Modified: Sep 16, 2024
PUBLISHED
Description
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
| Vendor | Product | Versions |
|---|---|---|
Red Hat, Inc. | keycloak | affected 3.4.0 |
Weaknesses (CWE)
References
https://bugzilla.redhat.com/show_bug.cgi?id=1484111
x_refsource_CONFIRM
RHSA-2017:2904
vendor-advisory
x_refsource_REDHAT
RHSA-2017:2905
vendor-advisory
x_refsource_REDHAT
RHSA-2017:2906
vendor-advisory
x_refsource_REDHAT
101601
vdb-entry
x_refsource_BID
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now