org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.1), org.keycloak:keycloak-account-freemarker (>=1.0-alpha-2, <=1.0.2.final) +6 more potentially affected by CVE-2014-3709 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=1.0.2.final)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.11.0, =1.0-alpha-2, =1.0-beta-4, =1.0-beta-4, =1.0-alpha-1, =1.0-alpha-2, =1.0-alpha-2, =1.0-alpha-1-12062013, =1.0.2.final Source cves: CVE-2014-3709 Source advisory: GHSA-XR6Q-QQX7-553G...

CVE-2014-3709

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...

CVE-2014-3709

Affected product: JBoss KeyCloak (org.keycloak.services.resources.SocialResource.callback). Root cause: lack of CSRF protection allows remote attackers to perform CSRF attacks. Affected version: before 1.0.3.Final. Impact: CSRF with potential unauthorized actions; no exploitation details provided...