Skip to main content

Insufficient Verification of Data Authenticity

CVE-2023-6236

High
7.3/10

Summary

A flaw was found in JBoss EAP. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in "OidcSessionTokenStore" when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. This vulnerability affects org.wildfly.security:wildfly-elytron-http-oidc versions through 2.2.4.Final, and 2.3.0.Final through 2.4.0.CR1.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-345 - Insufficient Verification of Data Authenticity

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References

Advisory Timeline

  • Published