Cross-site Request Forgery (CSRF)

2022-04-2909:42:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

keycloak

installed adapter

cross-site request forgery

csrf

denial of service

oidc logout endpoint

csrf protection

EPSS

Percentile

12.6%

JSON

org.keycloak:keycloak-installed-adapter is vulnerable to cross-site request forgery(CSRF). A local attacker is able to cause denial of service conditions because OIDC logout endpoint does not have any CSRF protection configured.

References

bugzilla.redhat.com/show_bug.cgi?id=1831662

github.com/advisories/GHSA-rvjg-gxwx-j5gf

github.com/keycloak/keycloak/commit/22a16ee899706de77fa21940c6b66fbddb88af0c

github.com/keycloak/keycloak/pull/10887

EPSS

Percentile

12.6%

JSON

Related for VERACODE:35329