PT-2017-17758 · Red Hat · Keycloak Node.Js Adapter

Publicado 2017-05-12 · Atualizado 2019-10-03 · CVE-2017-7474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak Node.js adapter versions 2.5 through 3.0

Description The issue is related to the incorrect handling of invalid tokens, which could allow an attacker to bypass authentication and access restricted information. This could potentially lead to further attacks.

Recommendations For Keycloak Node.js adapter versions 2.5 through 3.0, update to a version that correctly handles invalid tokens to prevent authentication bypass and potential further attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-253

Identificadores relacionados

CVE-2017-7474

GHSA-MW35-24GH-F82W

Produtos afetados

Keycloak Node.Js Adapter

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-7474 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mw35-24gh-f82w · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1445271 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7474 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2017-1203.html · Aviso do Fabricante