GitHub Advisoryadvisory · Maven

GHSA-p5xp-6vpf-jwvh Improper Input Validation and Cross-Site Request Forgery in Keycloak

HIGH Published 2019-09-23 Modified 2021-10-29 Official page ↗
Aliases
CVE-2019-10199
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-352
Reviewed
2019-09-19

Affected packages

• Maven org.keycloak:keycloak-core: < 7.0.0 → fixed in 7.0.0

Description

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.

Related

Alias · CVE (1)

  • CVE-2019-10199 It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-352 Cross-Site Request Forgery weakness

References