CVE-2017-12159CWE-613

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

published October 26, 2017

CVSS
—
EPSS
3%
Percentile
85.8
In the wild
Unconfirmed
What it is

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02711 · 85.8th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2017-10-26T17:00Z
EPSS history
Timeline
  • 26 OCT 17:00Z
    It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
    cvelistv5