CVE-2017-12160
published 2017-10-26CVE-2017-12160: It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting…
PriorityP342high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.89%
77.2th percentile
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat_inc | keycloak | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Keycloak Oauth Implementation Error
osv·2022-05-13
CVE-2017-12160 [HIGH] Keycloak Oauth Implementation Error
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
GHSA
Keycloak Oauth Implementation Error
ghsa·2022-05-13
CVE-2017-12160 [HIGH] CWE-287 Keycloak Oauth Implementation Error
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Red Hat
keycloak: resource privilege extension via access token in oauth
vendor_redhat·2017-10-17·CVSS 7.2
CVE-2017-12160 [HIGH] CWE-285 keycloak: resource privilege extension via access token in oauth
keycloak: resource privilege extension via access token in oauth
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Package: keycloak (Red Hat
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2017:2904https://access.redhat.com/errata/RHSA-2017:2905https://access.redhat.com/errata/RHSA-2017:2906https://bugzilla.redhat.com/show_bug.cgi?id=1484154https://access.redhat.com/errata/RHSA-2017:2904https://access.redhat.com/errata/RHSA-2017:2905https://access.redhat.com/errata/RHSA-2017:2906https://bugzilla.redhat.com/show_bug.cgi?id=1484154
2017-10-26
Published