CVE-2017-12160

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.

Source: CVE-2017-12160

답글 남기기

이메일 주소는 공개되지 않습니다. 필수 필드는 *로 표시됩니다