Redhat KeyCloak CVE-2019-3868 Session Hijacking Vulnerability

Bugtraq ID:	108061
Class:	Design Error
CVE:	CVE-2019-3868
Remote:	Yes
Local:	No
Published:	Apr 23 2019 12:00AM
Updated:	Apr 23 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Redhat Single Sign-On 7.2 for RHEL 7 Server 0 Redhat Single Sign-On 7.2 for RHEL 6 Server 0 Redhat Single Sign-On 7.0 + Redhat Linux 6.2 E sparc + Redhat Linux 6.2 E i386 + Redhat Linux 6.2 E alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha Redhat keycloak 6.0 Redhat keycloak 5.0 Redhat keycloak 4.8 Redhat keycloak 3.1 Redhat keycloak 1.0.3 Redhat keycloak 2.5.5 Redhat keycloak 2.5 Redhat keycloak 2.3 + Redhat Linux 6.2 E sparc + Redhat Linux 6.2 E i386 + Redhat Linux 6.2 E alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha Redhat keycloak 2.2.0 + Redhat Linux 7.0 Redhat keycloak 2.1 + Redhat Linux 6.2 E sparc + Redhat Linux 6.2 E i386 + Redhat Linux 6.2 E alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha Redhat keycloak 2.0 + Redhat Linux 7.0
Not Vulnerable:

Redhat KeyCloak CVE-2019-3868 Session Hijacking Vulnerability

Redhat KeyCloak is prone to a session-hijacking vulnerability.

An attacker can leverage this issue to gain unauthorized access to the affected application.

Redhat KeyCloak version 6.0.0 and prior are vulnerable.

Redhat KeyCloak CVE-2019-3868 Session Hijacking Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Redhat KeyCloak CVE-2019-3868 Session Hijacking Vulnerability

References:

• Keycloak Homepage (keycloak)
  
• Redhat Homepage (redhat)
  
• Bug 1679144 (CVE-2019-3868) - CVE-2019-3868 keycloak: session hijack using the (Redhat)
  
• CVE-2019-3868 (Redhat)
  
• RHSA-2019:0856 - Security Advisory (Redhat)
  
• RHSA-2019:0857 - Security Advisory (Redhat)
  
• RHSA-2019:0868 - Security Advisory (Redhat)