Описание
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Ссылки
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Issue TrackingVendor Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Issue TrackingVendor Advisory
Уязвимые конфигурации
EPSS
3.7 Low
CVSS3
8.1 High
CVSS3
5.8 Medium
CVSS2
Дефекты
Связанные уязвимости
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
It was found that the keycloak before 2.3.0 did not implement authenti ...
Improper Authentication in org.keycloak:keycloak-core
EPSS
3.7 Low
CVSS3
8.1 High
CVSS3
5.8 Medium
CVSS2