Lucene search

Veracode Vulnerability DatabaseVERACODE:20223

HistoryMay 16, 2019 - 4:00 a.m.

Session Hijacking

2019-05-1604:00:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

3.8 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

JSON

Keycloak is vulnerable to session hijacking attacks. This allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. An attacker could leverage this issue to gain unauthorized access to the affected application.

CPENameOperatorVersion
rh-sso7-keycloakeq2.5.15__2.Final_redhat_3.1.jbcs.el6
rh-sso7-keycloakeq3.4.6__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq2.5.5__2.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq2.5.14__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq3.4.12__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq3.4.10__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq3.4.12__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq3.4.3__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloakeq3.4.3__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloakeq2.5.7__1.Final_redhat_2.1.jbcs.el6

Name	Operator	Version
rh-sso7-keycloak	eq	2.5.15__2.Final_redhat_3.1.jbcs.el6
rh-sso7-keycloak	eq	3.4.6__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	2.5.5__2.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.14__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	3.4.12__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	3.4.10__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.12__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.3__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.3__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloak	eq	2.5.7__1.Final_redhat_2.1.jbcs.el6

Rows per page:

1-10 of 221

References

www.securityfocus.com/bid/108061

access.redhat.com/errata/RHSA-2019:0856

access.redhat.com/errata/RHSA-2019:1140

access.redhat.com/errata/RHSA-2019:2998

access.redhat.com/security/updates/classification/#moderate

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868

issues.jboss.org/browse/JBEAP-16660

3.8 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

JSON

Related for VERACODE:20223