3.8
Faible
CVE-2019-3868 Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for…
Description
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| keycloak | Versions non publiées |
Références
- bugzilla.redhat.com bugzilla.redhat.com
- 108061 www.securityfocus.com
- RHSA-2019:1140 access.redhat.com
- RHSA-2019:2998 access.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de keycloak
Les 22 CVE de keycloak →
CVE-2020-14366
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible…
6.8
Moyenne
CVE-2020-1758
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while…
5.3
Moyenne
CVE-2020-1714
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…
7.5
Élevée
CVE-2020-1718
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0
7.1
Élevée