CVE-2014-3709

High

Published: 18/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before version 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks due to lack of CSRF protection.

Risk Assessment

The lack of CSRF protection may lead to unauthorized actions being performed on behalf of users, posing a significant security risk to the application.

Recommendation

It is recommended to upgrade JBoss KeyCloak to version 1.0.3.Final or later to implement proper CSRF protection.

Other vulnerabilities in JBoss KeyCloak

CVE-2014-3651High
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.

Original NVD description (English source)

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS