JBoss Keycloak CSRF Vulnerability

GHSA-xr6q-qqx7-553g · CVE-2014-3709

Published May 17, 2022 · Modified Feb 16, 2024

Description

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2014-3709
WEB https://github.com/keycloak/keycloak/commit/bb132e1aa0b3b3a123883d0b8d0b788337df956d
WEB https://bugzilla.redhat.com/show_bug.cgi?id=1154971
WEB https://issues.jboss.org/browse/KEYCLOAK-765
WEB https://web.archive.org/web/20200227141715/http://www.securityfocus.com/bid/101508

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes