CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.

Published: Feb 11, 2021
Updated: May 9, 2024
CVE: CVE-2020-10734
GHSA: GHSA-rvjg-gxwx-j5gf
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 3.3
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v2:

Severity: Low
Score: 2.1
AV:L/AC:L/Au:N/C:N/I:N/A:P

CWEs:

CWE-352
CWE-601

Affected Software
References

Software	From	Fixed in
redhat / single_sign-on	7.0	7.0.x
redhat / jboss_fuse	7.0.0	7.0.0.x
org.keycloak / keycloak-oidc-client-adapter-pom	-	18.0.0

https://bugzilla.redhat.com/show_bug.cgi?id=1831662
https://github.com/keycloak/keycloak/security/advisories/GHSA-rvjg-gxwx-j5gf
https://issues.redhat.com/browse/KEYCLOAK-13653

Vulnerability Database

CVE-2020-10734

Deep Security Visibility Without the Complexity