PT-2019-16748 · Red Hat · Keycloak

Published 2019-04-24 · Updated 2020-02-10 · CVE-2019-3868

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions up to 6.0.0

Description The issue allows an attacker with access to the service provider backend to hijack a user's browser session. This is because Keycloak permits the use of the end user token, such as the JWT access or id token, as the session cookie for browser sessions in OIDC.

Recommendations For versions up to 6.0.0, consider disabling the use of the end user token as the session cookie for browser sessions to prevent session hijacking until a patch is available. Restrict access to the service provider backend to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-3868

GHSA-GC52-XJ6P-9PXP

RHSA-2019:0856

RHSA-2019:0857

Affected Products

Keycloak

References · 8

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2998 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3868 · Security Note
• https://osv.dev/vulnerability/GHSA-gc52-xj6p-9pxp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3868 · Vendor Advisory
• http://securityfocus.com/bid/108061 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3868 · Note