~ / search / GHSA-xr6q-qqx7-553g

GHSA-xr6q-qqx7-553g

JBoss Keycloak CSRF Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2014-3709

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 1.0.3.Final 1.0.3.Final

Details

As written in the advisory (Markdown source, shown as plain text).

The `org.keycloak.services.resources.SocialResource.callback` method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.

References

External links from the advisory. They lead to third-party sites.