CVE-2022-3916
20.09.2023, 15:15
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | keycloak | 𝑥 < 20.0.2 |
| redhat | single_sign-on | - |
| redhat | single_sign-on | 7.6 |
| redhat | openshift_container_platform | 4.9 |
| redhat | openshift_container_platform | 4.10 |
| redhat | openshift_container_platform_for_linuxone | 4.9 |
| redhat | openshift_container_platform_for_linuxone | 4.10 |
| redhat | openshift_container_platform_for_power | 4.9 |
| redhat | openshift_container_platform_for_power | 4.10 |
| redhat | openshift_container_platform_ibm_z_systems | 4.9 |
| redhat | openshift_container_platform_ibm_z_systems | 4.10 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-384 - Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
- CWE-613 - Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
References