ghsa-gc52-xj6p-9pxp
Vulnerability from github
Published
2019-04-30 15:37
Modified
2021-08-03 21:24
Severity
Summary
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Details
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.keycloak:keycloak-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "6.0.0" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2019-3868" ], "database_specific": { "cwe_ids": [ "CWE-200" ], "github_reviewed": true, "github_reviewed_at": "2019-04-30T15:16:15Z", "nvd_published_at": "2019-04-24T16:29:00Z", "severity": "MODERATE" }, "details": "Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.", "id": "GHSA-gc52-xj6p-9pxp", "modified": "2021-08-03T21:24:04Z", "published": "2019-04-30T15:37:21Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3868" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:1140" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:2998" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/108061" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Exposure of Sensitive Information to an Unauthorized Actor in Keycloak" }
Loading...