CVE-2017-12159: CSRF
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12159?
CVE-2017-12159 has a medium severity rating due to its potential for information disclosure and unauthorized access to authenticated user sessions.
How do I fix CVE-2017-12159?
To fix CVE-2017-12159, update Keycloak to a version greater than 3.4.0 or to 3.3.0 for Red Hat's Keycloak.
Which software is affected by CVE-2017-12159?
CVE-2017-12159 affects Keycloak versions up to 3.4.0 and Red Hat Single Sign-On versions up to 7.1.
What type of attack can be conducted using CVE-2017-12159?
An attacker can exploit CVE-2017-12159 to hijack an authenticated user session using the non-unique CSRF prevention cookie.
Is CVE-2017-12159 relevant to Red Hat Enterprise Linux?
CVE-2017-12159 is not directly relevant to Red Hat Enterprise Linux as it specifically pertains to Keycloak and related software.