SB2022121340 - Session takeover in keycloak
Published: December 13, 2022
Security Bulletin ID
SB2022121340
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficient Session Expiration (CVE-ID: CVE-2022-3916)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to reuse of session ids across root and user authentication sessions when using a client with the offline_access scope. An attacker with ability to obtain the root session ID can utilize the refresh token and authenticate to the application as another user.
The issue affects shared environments, where the attacker is able to obtain victim's cookies after the victim logs out.
Remediation
Install update from vendor's website.