Lucene search

GitHub Advisory DatabaseGHSA-RVJG-GXWX-J5GF

HistoryApr 28, 2022 - 5:13 p.m.

OIDC Logout redirect in keycloak

2022-04-2817:13:58

CWE-601

GitHub Advisory Database

github.com

keycloak

oidc logout

csrf protection

vulnerability

system availability

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

Percentile

12.6%

JSON

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.

Affected configurations

Vulners

Node

flask-oidc_projectflask-oidcRange<18.0.0

References

bugzilla.redhat.com/show_bug.cgi?id=1831662

github.com/advisories/GHSA-rvjg-gxwx-j5gf

github.com/keycloak/keycloak/security/advisories/GHSA-rvjg-gxwx-j5gf

issues.redhat.com/browse/KEYCLOAK-13653

nvd.nist.gov/vuln/detail/CVE-2020-10734

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

Percentile

12.6%

JSON

Related for GHSA-RVJG-GXWX-J5GF