CVE-2019-10157

Опубликовано: 12 июн. 2019

Источник: nvd

CVSS3: 4.7

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.

Ссылки

http://www.securityfocus.com/bid/108734
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157
Issue Tracking
Vendor Advisory
http://www.securityfocus.com/bid/108734
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*

Версия до 4.8.3 (исключая)

cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*

Версия до 7.3.2 (исключая)

EPSS

Процентиль: 4%

0.00019

Низкий

4.7 Medium

CVSS3

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-345

CWE-287

Связанные уязвимости

CVE-2019-10157

CVSS3: 4.7

redhat

больше 6 лет назад

CVE-2019-10157

CVSS3: 4.7

debian

больше 6 лет назад

It was found that Keycloak's Node.js adapter before version 4.8.3 did ...

GHSA-68hw-vfh7-xvg8

CVSS3: 5.5

github

больше 6 лет назад

Forced Logout in keycloak-connect

EPSS

Процентиль: 4%

0.00019

Низкий

4.7 Medium

CVSS3

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-345

CWE-287