CVE-2019-10199: CSRF
First published: Thu Jul 11 2019(Updated: )
A vulnerability was found in keycloak. A CSRF attack can be performed in My Resources functionality in the Account Console. The attacker can trick the user to perform operations by using social engineering or any other mean that can result in a request to Keycloak from an untrusted domain. References: <a href="https://issues.jboss.org/browse/KEYCLOAK-10775">https://issues.jboss.org/browse/KEYCLOAK-10775</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/keycloak | <7.0.0 | 7.0.0 |
| Keycloak | <=6.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10199
- https://issues.jboss.org/browse/KEYCLOAK-10775
- https://access.redhat.com/errata/RHSA-2019:2483
- https://access.redhat.com/security/cve/cve-2019-10199
- https://access.redhat.com/errata/RHSA-2020:2067
- https://access.redhat.com/errata/RHSA-2020:2366
- https://bugzilla.redhat.com/show_bug.cgi?id=1729261
- https://www.cve.org/CVERecord?id=CVE-2019-10199 https://nvd.nist.gov/vuln/detail/CVE-2019-10199
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2019-10199?
CVE-2019-10199 has been assigned a medium severity rating due to its potential for CSRF attacks targeting the My Resources functionality.
How do I fix CVE-2019-10199?
To fix CVE-2019-10199, upgrade your Keycloak installation to version 7.0.0 or later.
Which versions of Keycloak are affected by CVE-2019-10199?
CVE-2019-10199 affects Keycloak versions up to and including 6.0.1.
What type of attack is associated with CVE-2019-10199?
CVE-2019-10199 is associated with a Cross-Site Request Forgery (CSRF) attack.
Can CVE-2019-10199 be exploited via social engineering?
Yes, CVE-2019-10199 can be exploited through social engineering tactics to trick users into making unauthorized requests.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-10199
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/redhat
- canonical/keycloak
- version/keycloak/6.0.1