Lucene search

Veracode Vulnerability DatabaseVERACODE:5342

HistoryOct 27, 2017 - 2:26 a.m.

Reusable Refresh Tokens

2017-10-2702:26:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

JSON

Keycloak services has resuable refresh tokens. If an attacker using a pre-compromised system creates a refresh token pair, this token can be used indefinitely regardless of permission revocation.

CPENameOperatorVersion
keycloak rest servicesle1.0.5.Final
keycloak rest servicesle1.0-alpha-4
keycloak rest servicesle2.2.1.Final
keycloak rest servicesle3.3.0.CR2
rh-sso7-keycloakeq2.5.5__2.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq2.5.10__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq2.4.0__4.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq2.4.0__4.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq2.5.7__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloakeq2.5.5__2.Final_redhat_1.1.jbcs.el6

Name	Operator	Version
keycloak rest services	le	1.0.5.Final
keycloak rest services	le	1.0-alpha-4
keycloak rest services	le	2.2.1.Final
keycloak rest services	le	3.3.0.CR2
rh-sso7-keycloak	eq	2.5.5__2.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.10__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	2.4.0__4.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	2.4.0__4.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.7__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloak	eq	2.5.5__2.Final_redhat_1.1.jbcs.el6

Rows per page:

1-10 of 121

References

access.redhat.com/errata/RHSA-2017:2904

access.redhat.com/errata/RHSA-2017:2905

access.redhat.com/errata/RHSA-2017:2906

bugzilla.redhat.com/show_bug.cgi?id=1484154

github.com/keycloak/keycloak/commit/fea4c54adc6a1fdafb725b89874c389d54b6d04a

issues.jboss.org/browse/KEYCLOAK-5280

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

JSON

Related for VERACODE:5342