CVE-2019-10157
keycloak: Node.js adapter internal NBF can be manipulated leading to DoS.
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
Se encontró que el adaptador Node.js de Keycloak antes de la versión 4.8.3 no verificó correctamente el token web recibido del servidor en su cierre de sesión de backchannel. Un atacante con acceso local podría usar esto para construir un token web malicioso que establezca un parámetro NBF que podría impedir el acceso de los usuarios de forma indefinida.
It was found that Keycloak's Node.js adapter did not properly verify the web token received from the server in its backchannel logout. An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-27 CVE Reserved
- 2019-06-11 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
- CWE-345: Insufficient Verification of Data Authenticity
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/108734 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157 | 2019-10-09 | |
https://access.redhat.com/security/cve/CVE-2019-10157 | 2019-06-11 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1702953 | 2019-06-11 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Keycloak Search vendor "Redhat" for product "Keycloak" | < 4.8.3 Search vendor "Redhat" for product "Keycloak" and version " < 4.8.3" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Single Sign-on Search vendor "Redhat" for product "Single Sign-on" | < 7.3.2 Search vendor "Redhat" for product "Single Sign-on" and version " < 7.3.2" | - |
Affected
|