PT-2017-17758 · Red Hat · Keycloak Node.Js Adapter

Published 2017-05-12 · Updated 2019-10-03 · CVE-2017-7474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak Node.js adapter versions 2.5 through 3.0

Description The issue is related to the incorrect handling of invalid tokens, which could allow an attacker to bypass authentication and access restricted information. This could potentially lead to further attacks.

Recommendations For Keycloak Node.js adapter versions 2.5 through 3.0, update to a version that correctly handles invalid tokens to prevent authentication bypass and potential further attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-253

Related Identifiers

CVE-2017-7474

GHSA-MW35-24GH-F82W

Affected Products

Keycloak Node.Js Adapter

References · 5

• https://osv.dev/vulnerability/CVE-2017-7474 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw35-24gh-f82w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7474 · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-1203.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1445271 · Note