Search/CVE-2019-3868
● CVE — Low

CVE-2019-3868

VendorredhatProductkeycloakDiscoveredApr 24, 2019UpdatedNov 21, 2024

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

View graph Watch Export
CVSS v3.1
3.8 LOW
EPSS
1.00%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
ConfidentialityLOW
IntegrityLOW
AvailabilityNONE
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Connections
2 relationships
Timeline
disclosure → media coverage
Apr 24, 2019
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024