CVE-2020-10734
Low
Description
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.
SeverityLow
CVSS3.3
Exploit probability—
Product
Redhat Keycloak
PublishedFeb 11, 2021
First seenFeb 11, 2021
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- org.keycloak:keycloak-oidc-client-adapter-pom18.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | No range specified | — |
| redhat jboss_fuse | 7.0.0 | — |
| redhat openshift_application_runtimes | No range specified | — |
| redhat single_sign-on | 7.0 | — |
| org.keycloak:keycloak-oidc-client-adapter-pomMaven | v < 18.0.0 | 18.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.