GHSA-gc52-xj6p-9pxp

ghsaUSosv

Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

view advisory published 2019-04-30Licence: CC-BY-4.0

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-3868US	low3.8	1.00% (63rd)	—	2019-04-24
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/108061WEB
https://access.redhat.com/errata/RHSA-2019:1140WEB
https://access.redhat.com/errata/RHSA-2019:2998WEB
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-3868ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan