CVE-2017-12159
keycloak: CSRF token fixation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Se ha descubierto que la cookie empleada para la prevención de CSRF en Keycloak no era única para cada sesión. Un atacante podría usar este fallo para obtener acceso a una sesión de un usuario autenticado, conduciendo a una posible divulgación de información o a más ataques.
Red Hat Single Sign-On 7.1 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. The Node.js adapter provides a simple module for authentication and authorization in Node.js applications. This release of Red Hat Single Sign-On 7.1.3 serves as a replacement for Red Hat Single Sign-On 7.1.2, and includes several bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-08-01 CVE Reserved
- 2017-10-17 CVE Published
- 2024-09-16 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-613: Insufficient Session Expiration
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/101601 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2017:2904 | 2019-10-09 | |
| https://access.redhat.com/errata/RHSA-2017:2905 | 2019-10-09 | |
| https://access.redhat.com/errata/RHSA-2017:2906 | 2019-10-09 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1484111 | 2017-10-17 | |
| https://access.redhat.com/security/cve/CVE-2017-12159 | 2017-10-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Single Sign On Search vendor "Redhat" for product "Single Sign On" | 7.0 Search vendor "Redhat" for product "Single Sign On" and version "7.0" | - |
Affected
| in | Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0" | - |
Safe
|
| Redhat Search vendor "Redhat" | Single Sign On Search vendor "Redhat" for product "Single Sign On" | 7.0 Search vendor "Redhat" for product "Single Sign On" and version "7.0" | - |
Affected
| in | Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Safe
|
| Redhat Search vendor "Redhat" | Single Sign On Search vendor "Redhat" for product "Single Sign On" | 7.1 Search vendor "Redhat" for product "Single Sign On" and version "7.1" | - |
Affected
| in | Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0" | - |
Safe
|
| Redhat Search vendor "Redhat" | Single Sign On Search vendor "Redhat" for product "Single Sign On" | 7.1 Search vendor "Redhat" for product "Single Sign On" and version "7.1" | - |
Affected
| in | Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Safe
|
| Keycloak Search vendor "Keycloak" | Keycloak Search vendor "Keycloak" for product "Keycloak" | - | - |
Affected
| ||||||