Low severity · published Apr 24, 2019
CVE-2019-3868
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC
3.8
CVSS
1%
EPSS
No
On KEV
Description
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Keycloak · Redhat
through 6.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3868
Third Party Advisory
http://www.securityfocus.com/bid/108061
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:1140
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:2998
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868
More from Keycloak
9.8
CVE-2022-1245
A privilege escalation flaw was found in the token exchange feature of keycloak
9.8
CVE-2019-14910
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case…
9.6
CVE-2021-20195
A flaw was found in keycloak in versions before 13.0.0
9.1
CVE-2022-3782
keycloak: path traversal via double URL encoding
9.1
CVE-2019-14837
A flaw was found in keycloack before version 8.0.0