PT-2017-12374 · Red Hat · Keycloak

Publicado 2017-10-26 · Atualizado 2026-05-18 · CVE-2017-12159

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak's CSRF prevention mechanism, where the cookie used was not unique to each session. This could allow an attacker to gain access to an authenticated user's session, potentially leading to information disclosure or further attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CLEANSTART-2026-FA60324

CLEANSTART-2026-GX01236

CLEANSTART-2026-KC06018

CLEANSTART-2026-PO27799

CLEANSTART-2026-SG80587

CVE-2017-12159

GHSA-7FMW-85QM-H22P

RHSA-2017:2904

RHSA-2017:2905

Produtos afetados

Keycloak

Referências · 86

• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FA60324.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SG80587.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PO27799.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KC06018.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GX01236.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SG80587 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 · Nota
• https://osv.dev/vulnerability/GHSA-H5FG-JPGR-RV9C · Nota
• https://access.redhat.com/errata/RHSA-2017:2905 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-42585 · Nota
• https://osv.dev/vulnerability/CLEANSTART-2026-KC06018 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1484111 · Nota
• https://osv.dev/vulnerability/ghsa-5rfx-cp42-p624 · Nota