5.5
CVSSv2

CVE-2019-3868

Published: 24/04/2019 Updated: 10/02/2020
CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8
CVSS v3 Base Score: 3.8 | Impact Score: 2.5 | Exploitability Score: 1.2
VMScore: 490
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N

Vulnerability Summary

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

redhat keycloak

Vendor Advisories

Synopsis Important: Red Hat Single Sign-On 731 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 73 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Moderate: Red Hat Single Sign-On 727 security update on RHEL 6 Type/Severity Security Advisory: Moderate Topic Security updates for Red Hat Single Sign-On 727 packages are now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: Red Hat Single Sign-On 727 security update on RHEL 7 Type/Severity Security Advisory: Moderate Topic Security updates for Red Hat Single Sign-On 727 packages are now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: Red Hat Single Sign-On 727 security update Type/Severity Security Advisory: Moderate Topic A security update is now available for Red Hat Single Sign-On 72 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerab ...
Synopsis Important: Red Hat support for Spring Boot 2112 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Application RuntimesRed Hat Product Security has rated this update as having a security impact of Important A Common Vuln ...
Synopsis Important: Red Hat OpenShift Application Runtimes Thorntail 250 security & bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat OpenShift Application RuntimesRed Hat Product Security has rated this update as having a security impact of Import ...