Search for vulnerabilities
Vulnerability details: VCID-hbzw-6rfa-aaar
Vulnerability ID VCID-hbzw-6rfa-aaar
Aliases CVE-2017-12160
GHSA-qc72-gfvw-76h7
Summary It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-287 Improper Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-285 Improper Authorization
System Score Found at
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2017:2904
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2017:2904
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2017:2905
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2017:2905
cvssv3.1 6.5 https://access.redhat.com/errata/RHSA-2017:2906
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2017:2906
cvssv3 3.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12160.json
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00171 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.00485 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0101 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=1484154
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qc72-gfvw-76h7
cvssv3.1 6.8 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv2 6.5 https://nvd.nist.gov/vuln/detail/CVE-2017-12160
cvssv3 7.2 https://nvd.nist.gov/vuln/detail/CVE-2017-12160
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2017-12160
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2017:2904
https://access.redhat.com/errata/RHSA-2017:2905
https://access.redhat.com/errata/RHSA-2017:2906
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12160.json
https://api.first.org/data/v1/epss?cve=CVE-2017-12160
https://github.com/keycloak/keycloak
1484154 https://bugzilla.redhat.com/show_bug.cgi?id=1484154
cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*
CVE-2017-12160 https://nvd.nist.gov/vuln/detail/CVE-2017-12160
GHSA-qc72-gfvw-76h7 https://github.com/advisories/GHSA-qc72-gfvw-76h7
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/errata/RHSA-2017:2904
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/errata/RHSA-2017:2905
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/errata/RHSA-2017:2906
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12160.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12160
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.54757
EPSS Score 0.00171
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.