CVE-2019-10199
published 2019-08-14CVE-2019-10199: It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an…
PriorityP341high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.50%
39.2th percentile
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | keycloak | — | — |
| redhat | keycloak | <= 6.0.1 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.04.6MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Input Validation and Cross-Site Request Forgery in Keycloak
ghsa·2019-09-23
CVE-2019-10199 [HIGH] CWE-20 Improper Input Validation and Cross-Site Request Forgery in Keycloak
Improper Input Validation and Cross-Site Request Forgery in Keycloak
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
OSV
Improper Input Validation and Cross-Site Request Forgery in Keycloak
osv·2019-09-23
CVE-2019-10199 [HIGH] Improper Input Validation and Cross-Site Request Forgery in Keycloak
Improper Input Validation and Cross-Site Request Forgery in Keycloak
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
Red Hat
keycloak: CSRF check missing in My Resources functionality in the Account Console
vendor_redhat·2019-08-13·CVSS 8.8
CVE-2019-10199 [HIGH] CWE-352 keycloak: CSRF check missing in My Resources functionality in the Account Console
keycloak: CSRF check missing in My Resources functionality in the Account Console
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
Package: keycloak (Red Hat Fuse 7) - Will not fix
Package: keycloak (Red Hat Mobile Application Platform 4) - Will not fix
Package: keycloak (Red Hat OpenShift Application Runtimes) - Out of support scope
Package: rh-sso7-keycloak (Red Ha
No detection rules found.
No public exploits indexed.
2019-08-14
Published