CVSS: 8.1EPSS: 0%CPEs: 7EXPL: 0CVE-2018-14657 – keycloak: brute force protection not working for the entire login workflow
https://notcve.org/view.php?id=CVE-2018-14657
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures. Se ha descubierto un error en Keycloak 4.2.1.Final y 4.3.0.Final. Cuando TOPT está habilitado, la implementación incorrecta del algoritmo de detección de fuerza bruta no aplica sus medidas de protección. • https://access.redhat.com/errata/RHSA-2018:3592 https://access.redhat.com/errata/RHSA-2018:3593 https://access.redhat.com/errata/RHSA-2018:3595 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657 https://access.redhat.com/security/cve/CVE-2018-14657 https://bugzilla.redhat.com/show_bug.cgi?id=1625404 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2018-14655 – keycloak: XSS-Vulnerability with response_mode=form_post
https://notcve.org/view.php?id=CVE-2018-14655
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login. Se ha descubierto un error en Keycloak 3.4.3.Final, 4.0.0.Beta2 y 4.3.0.Final. Al emplear "response_mode=form_post", es posible inyectar código JavaScript arbitrario mediante el parámetro "state" en la URL de autenticación. • https://access.redhat.com/errata/RHSA-2018:3592 https://access.redhat.com/errata/RHSA-2018:3593 https://access.redhat.com/errata/RHSA-2018:3595 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655 https://access.redhat.com/security/cve/CVE-2018-14655 https://bugzilla.redhat.com/show_bug.cgi?id=1625396 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-10894 – keycloak: auth permitted with expired certs in SAML client
https://notcve.org/view.php?id=CVE-2018-10894
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks. Se ha descubierto que la autenticación SAML en Keycloak 3.4.3.Final autenticaba incorrectamente los certificados caducados. Un usuario malicioso podría aprovecharse de esto para acceder a datos no autorizados o, posiblemente, llevar a cabo más ataques. • https://access.redhat.com/errata/RHSA-2018:3592 https://access.redhat.com/errata/RHSA-2018:3593 https://access.redhat.com/errata/RHSA-2018:3595 https://access.redhat.com/errata/RHSA-2019:0877 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10894 https://access.redhat.com/security/cve/CVE-2018-10894 https://bugzilla.redhat.com/show_bug.cgi?id=1599434 • CWE-295: Improper Certificate Validation CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-12159 – keycloak: CSRF token fixation
https://notcve.org/view.php?id=CVE-2017-12159
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks. Se ha descubierto que la cookie empleada para la prevención de CSRF en Keycloak no era única para cada sesión. Un atacante podría usar este fallo para obtener acceso a una sesión de un usuario autenticado, conduciendo a una posible divulgación de información o a más ataques. • http://www.securityfocus.com/bid/101601 https://access.redhat.com/errata/RHSA-2017:2904 https://access.redhat.com/errata/RHSA-2017:2905 https://access.redhat.com/errata/RHSA-2017:2906 https://bugzilla.redhat.com/show_bug.cgi?id=1484111 https://access.redhat.com/security/cve/CVE-2017-12159 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2017-12158 – keycloak: reflected XSS using HOST header
https://notcve.org/view.php?id=CVE-2017-12158
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server. Se ha descubierto que Keycloak podría aceptar una URL de cabecera HOST en la consola de administración y emplearla para determinar localizaciones de recursos web. Un atacante podría usar este fallo contra un usuario autenticado para lograr un XSS reflejado mediante un servidor malicioso. It was found that keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. • http://www.securityfocus.com/bid/101618 https://access.redhat.com/errata/RHSA-2017:2904 https://access.redhat.com/errata/RHSA-2017:2905 https://access.redhat.com/errata/RHSA-2017:2906 https://bugzilla.redhat.com/show_bug.cgi?id=1489161 https://access.redhat.com/security/cve/CVE-2017-12158 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •