Keycloak records
6 published records for vendor keycloak.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-253 Incorrect Check of Function Return Value1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-400 Uncontrolled Resource Consumption1
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')1
- CWE-602 Client-Side Enforcement of Server-Side Security1
- CWE-613 Insufficient Session Expiration1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2017-7474No exploit | It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.keycloak · keycloak-nodejs-auth-utils · CWE-253 | Critical9.8 | — | 2.5% | May 12, 2017 |
35Monitor | CVE-2017-12161No exploit | It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset requekeycloak · keycloak · CWE-602 | High8.8 | — | 1.3% | Feb 21, 2018 |
35Monitor | CVE-2014-3709No exploit | The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct ckeycloak · keycloak · CWE-352 | High8.8 | — | 0.8% | Oct 18, 2017 |
31Monitor | CVE-2017-12159No exploit | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.keycloak · keycloak · CWE-613 | High7.5 | — | 2.7% | Oct 26, 2017 |
30Monitor | CVE-2014-3651No exploit | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size keycloak · keycloak · CWE-400 | High7.5 | — | 1.6% | Dec 29, 2017 |
21Monitor | CVE-2017-12158No exploit | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.keycloak · keycloak · CWE-444 | Medium5.4 | — | 1.0% | Oct 26, 2017 |
- CVE-2017-747440Plan
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.
CriticalCVSS 9.8No exploitEPSS 2%keycloak · keycloak-nodejs-auth-utilsMay 12, 2017
- CVE-2017-1216135Monitor
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque
HighCVSS 8.8No exploitEPSS 1%keycloak · keycloakFeb 21, 2018
- CVE-2014-370935Monitor
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct c
HighCVSS 8.8No exploitEPSS 0%keycloak · keycloakOct 18, 2017
- CVE-2017-1215931Monitor
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.
HighCVSS 7.5No exploitEPSS 2%keycloak · keycloakOct 26, 2017
- CVE-2014-365130Monitor
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size
HighCVSS 7.5No exploitEPSS 1%keycloak · keycloakDec 29, 2017
- CVE-2017-1215821Monitor
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.
MediumCVSS 5.4No exploitEPSS 1%keycloak · keycloakOct 26, 2017