Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-12159

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

Published

2017-10-26T17:29:00.267

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-613
Type: Primary
CWE-613

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	single_sign_on	7.0	Yes
Application	redhat	single_sign_on	7.1	Yes
Operating System	redhat	enterprise_linux_server	6.0	No
Operating System	redhat	enterprise_linux_server	7.0	No
Application	keycloak	keycloak	-	Yes

References

http://www.securityfocus.com/bid/101601 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2017:2904 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2017:2905 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2017:2906 Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=1484111 Issue Tracking, Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/101601 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:2904 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:2905 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:2906 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=1484111 Issue Tracking, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)