CVE-2019-3868

Опубликовано: 24 апр. 2019

Источник: nvd

CVSS3: 3.8

CVSS2: 5.5

EPSS Низкий

Описание

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

Ссылки

http://www.securityfocus.com/bid/108061
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140
https://access.redhat.com/errata/RHSA-2019:2998
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868
Issue Tracking
Vendor Advisory
http://www.securityfocus.com/bid/108061
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140
https://access.redhat.com/errata/RHSA-2019:2998
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*

Версия до 6.0.0 (включая)

EPSS

Процентиль: 52%

0.00291

Низкий

3.8 Low

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2019-3868

CVSS3: 3.8

redhat

почти 7 лет назад

CVE-2019-3868

CVSS3: 3.8

debian

почти 7 лет назад

Keycloak up to version 6.0.0 allows the end user token (access or id t ...

GHSA-gc52-xj6p-9pxp

CVSS3: 3.8

github

почти 7 лет назад

Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

EPSS

Процентиль: 52%

0.00291

Низкий

3.8 Low

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-200