GitHub Advisoryadvisory · Maven

GHSA-gc52-xj6p-9pxp Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

MEDIUM Published 2019-04-30 Modified 2021-08-03 Official page ↗
Aliases
CVE-2019-3868
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-200
Reviewed
2019-04-30

Affected packages

• Maven org.keycloak:keycloak-core: < 6.0.0 → fixed in 6.0.0

Description

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.

Related

Alias · CVE (1)

  • CVE-2019-3868 Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References