3.7
Faible
CVE-2016-8609 It was found that the keycloak before 2.3.0 did not implement authentication flow correctly
Description
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| keycloak | 2.3.0 | Pas de correctif indiqué |
Références
- bugzilla.redhat.com bugzilla.redhat.com
- RHSA-2016:2945 rhn.redhat.com
- 1037460 www.securitytracker.com
- 95070 www.securityfocus.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de keycloak
Les 22 CVE de keycloak →
CVE-2020-14366
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible…
6.8
Moyenne
CVE-2020-1758
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while…
5.3
Moyenne
CVE-2020-1714
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…
7.5
Élevée
CVE-2020-1718
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0
7.1
Élevée