CVE-2017-12160: High severity redhat Keycloak vulnerability
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12160?
CVE-2017-12160 has a medium severity rating due to potential risks associated with token misuse.
How do I fix CVE-2017-12160?
To fix CVE-2017-12160, upgrade to Keycloak version 3.4.0 or later or to version 3.3.0 specifically designed to address this vulnerability.
What software is affected by CVE-2017-12160?
CVE-2017-12160 affects Keycloak versions prior to 3.4.0 and 3.3.0.
What is the primary issue with CVE-2017-12160?
The primary issue with CVE-2017-12160 is that it allows resource owners to indefinitely use tokens even after permission has been revoked.
Who should be concerned about CVE-2017-12160?
Organizations using affected versions of Keycloak should be concerned about CVE-2017-12160 due to potential unauthorized access risks.