CVE-2017-12159 Keycloak CSRF Vulnerability

What is CVE-2017-12159?

CVE-2017-12159 is a high-severity vulnerability in Red Hat, Inc. keycloak, published on 26 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

Weakness: CWE-613

Which versions are affected by CVE-2017-12159?

2 open source packages ship an affected version, including org.keycloak:keycloak-parent. It affects 2 products.

Products include Keycloak Keycloak, Redhat Single Sign On.

How do I fix CVE-2017-12159?

Upgrade org.keycloak:keycloak-parent to 3.4.0 or later.

Is CVE-2017-12159 being exploited?

There is no known exploitation of CVE-2017-12159 in the wild and no public exploit code.

Other vulnerabilities in Red Hat, Inc. keycloak

• CVE-2017-12161 Moderate severity vulnerability that affects org.keycloak:keycloak-core High 8.8
• CVE-2014-3709 JBoss Keycloak CSRF Vulnerability High 8.8
• CVE-2014-3651 Keycloak vulnerable to uncontrolled resource consumption High 7.5
• CVE-2017-12158 Keycloak Reflected XSS Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-XS62872, GHSA-7fmw-85qm-h22p, MINI-5387-xrgm-5r86, MINI-5942-6869-9whp.