CVE-2017-12161
Moderate severity vulnerability that affects org.keycloak:keycloak-core
EPSS 1.3%
描述
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.
如何修補 CVE-2017-12161
要修補 CVE-2017-12161,請將受影響套件升級到下列已修補版本。
- Maven/org.keycloak:keycloak-core—升級至 3.4.2 或更新版本
CVE-2017-12161 正在被利用嗎?
低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 3.4.2