Path to dependency file: /jetty-infinispan/infinispan-remote-query/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/wildfly/security/wildfly-elytron-http-oidc/2.2.1.Final/wildfly-elytron-http-oidc-2.2.1.Final.jar
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option.
EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw.
CVE-2023-6236 - High Severity Vulnerability
WildFly Security HTTP OIDC Mechanism Implementation
Path to dependency file: /jetty-infinispan/infinispan-remote-query/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/wildfly/security/wildfly-elytron-http-oidc/2.2.1.Final/wildfly-elytron-http-oidc-2.2.1.Final.jar
Dependency Hierarchy: - infinispan-client-hotrod-11.0.17.Final.jar (Root Library) - wildfly-elytron-2.2.1.Final.jar - :x: **wildfly-elytron-http-oidc-2.2.1.Final.jar** (Vulnerable Library)
Found in HEAD commit: 6eace92456f444de3e8f0abbab5c5bed2ae9dba6
Found in base branch: master
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw.
Publish Date: 2024-04-10
URL: CVE-2023-6236
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-6236
Release Date: 2024-04-10
Fix Resolution (org.wildfly.security:wildfly-elytron-http-oidc): 2.2.6.Final
Direct dependency fix Resolution (org.infinispan:infinispan-client-hotrod): 11.0.18.Final
Step up your Open Source Security Game with Mend here