CVE-2014-3709: CSRF
It was discovered that the org.keycloak.services.resources.SocialResource.callback(String) method implementation lacked CSRF protection. A remote attacker could use this flaw to gain access to a KeyCloak managed accounts or perform other attacks.
Other sources
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3709?
CVE-2014-3709 is considered to have a medium severity due to its potential for CSRF attacks on Keycloak managed accounts.
How do I fix CVE-2014-3709?
To fix CVE-2014-3709, upgrade to Keycloak version 1.0.3.Final or later.
What type of vulnerability is CVE-2014-3709?
CVE-2014-3709 is a Cross-Site Request Forgery (CSRF) vulnerability.
Which software is affected by CVE-2014-3709?
CVE-2014-3709 affects Keycloak versions up to 1.0.2.Final.
What can an attacker do with CVE-2014-3709?
An attacker exploiting CVE-2014-3709 could gain unauthorized access to Keycloak managed accounts.