CVE-2014-3709
High
Description
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Keycloak
PublishedOct 18, 2017
First seenOct 18, 2017
How to fix
Update
- org.keycloak:keycloak-services1.0.3.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak keycloak | v ≤ 1.0.2.final | — |
| org.keycloak:keycloak-servicesMaven | v < 1.0.3.Final | 1.0.3.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.