Lucene search
Redhat.comRH:CVE-2019-3868HistoryApr 23, 2019 - 5:24 p.m.
CVE-2019-3868
2019-04-2317:24:06
redhat.com
access.redhat.com
14
EPSS
0.001
Percentile
47.9%
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
Related
github
github
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
2019-04-30 15:37:21
osv
osv
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
2019-04-30 15:37:21
CVE-2019-3868
2019-04-24 16:29:02
cve
cve
CVE-2019-3868
2019-04-24 16:29:02
nessus
nessus
redhat
redhat
veracode
veracode
Session Hijacking
2019-05-16 04:00:01
prion
prion
Session fixation
2019-04-24 16:29:00
cvelist
cvelist
CVE-2019-3868
2019-04-24 15:21:50
nvd
nvd
CVE-2019-3868
2019-04-24 16:29:02