The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3592 advisory.

  - keycloak: auth permitted with expired certs in SAML client (CVE-2018-10894)

  - keycloak: expiration not validated in SAML broker consumer endpoint (CVE-2018-14637)

  - keycloak: XSS-Vulnerability with response_mode=form_post (CVE-2018-14655)

  - keycloak: brute force protection not working for the entire login workflow (CVE-2018-14657)

  - keycloak: Open Redirect in Login and Logout (CVE-2018-14658)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : Red Hat Single Sign-On 7.2.5 on RHEL 6 (RHSA-2018:3592)

high Nessus Plugin ID 118949

Version 1.10