CVE-2019-10157
Medium
Description
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
SeverityMedium
CVSS4.7
Exploit probability—
Product
Redhat Keycloak
PublishedJun 12, 2019
First seenJun 12, 2019
Weakness typeCWE-345CWE-345
How to fix
Update
- redhat keycloak4.8.3 or later
- redhat single_sign-on7.3.2 or later
- keycloak-connect4.8.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | v < 4.8.3 | 4.8.3 |
| redhat single_sign-on | v < 7.3.2 | 7.3.2 |
| keycloak-connectnpm | v < 4.8.3 | 4.8.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.