Описание
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
It was discovered that the org.keycloak.services.resources.SocialResource.callback(String) method implementation lacked Cross-Site Request Forgery (CSRF) protection. A remote attacker could use this flaw to gain access to KeyCloak managed accounts or perform other attacks.
Отчет
This issue does not affect any supported Red Hat products.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Web Server 1 | mobile | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | others | Not affected |
Показывать по
Дополнительная информация
Статус:
4.3 Medium
CVSS2
Связанные уязвимости
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
4.3 Medium
CVSS2