CVE-2017-12161: Weak Password Recovery Mechanism for Forgotten Password

October 18, 2018 (updated January 8, 2021)

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.

References

bugzilla.redhat.com/show_bug.cgi?id=1484564
github.com/advisories/GHSA-959q-32g8-vvp7
github.com/keycloak/keycloak-documentation/pull/268/commits/a2b58aadee42af2c375b72e86dffc2cf23cc3770
nvd.nist.gov/vuln/detail/CVE-2017-12161

Code Behaviors & Features

Detect and mitigate CVE-2017-12161 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →