Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-3916
HistorySep 20, 2023 - 3:15 p.m.

CVE-2022-3916

2023-09-2015:15:11
CWE-613
CWE-384
[email protected]
web.nvd.nist.gov
1
keycloak
offline_access
shared computers
cookies
session validation
attacker
refresh token

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

37.7%

JSON

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

Affected configurations

NVD
Node
redhatkeycloakRange<20.0.2
OR
redhatsingle_sign-onMatch-text-only
Node
redhatsingle_sign-onMatch7.6
AND
redhatenterprise_linuxMatch7.0
OR
redhatenterprise_linuxMatch8.0
OR
redhatenterprise_linuxMatch9.0
Node
redhatopenshift_container_platformMatch4.9
OR
redhatopenshift_container_platformMatch4.10
OR
redhatopenshift_container_platform_for_linuxoneMatch4.9
OR
redhatopenshift_container_platform_for_linuxoneMatch4.10
OR
redhatopenshift_container_platform_for_powerMatch4.9
OR
redhatopenshift_container_platform_for_powerMatch4.10
OR
redhatopenshift_container_platform_ibm_z_systemsMatch4.9
OR
redhatopenshift_container_platform_ibm_z_systemsMatch4.10
AND
redhatenterprise_linuxMatch8.0

Related

osv 2
vulnrichment 1
github 1
redhatcve 1
veracode 1
cvelist 1
cve 1
prion 1
nessus 6
redhat 10
osv
osv
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
2022-12-13 19:44:33
CVE-2022-3916
2023-09-20 15:15:11
vulnrichment
vulnrichment
CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens
2023-09-20 14:28:52
github
github
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
2022-12-13 19:44:33
redhatcve
redhatcve
CVE-2022-3916
2022-11-09 18:25:59
veracode
veracode
Improper Authentication
2022-12-14 08:18:38
cvelist
cvelist
CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens
2023-09-20 14:28:52
cve
cve
CVE-2022-3916
2023-09-20 15:15:11
prion
prion
Design/Logic Flaw
2023-09-20 15:15:00
nessus
nessus
RHEL 7 : Red Hat Single Sign-On 7.6.1 security update on RHEL 7 (Important) (RHSA-2022:8961)
2022-12-13 00:00:00
RHEL 9 : Red Hat Single Sign-On 7.6.1 security update on RHEL 9 (Important) (RHSA-2022:8963)
2022-12-13 00:00:00
RHEL 8 : Red Hat Single Sign-On 7.6.1 security update on RHEL 8 (Important) (RHSA-2022:8962)
2022-12-13 00:00:00
redhat
redhat
(RHSA-2022:8965) Important: Red Hat Single Sign-On 7.6.1 security update
2022-12-13 14:03:39
(RHSA-2022:8963) Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 9
2022-12-13 13:57:13
(RHSA-2022:8962) Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 8
2022-12-13 13:57:11

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

37.7%

JSON
Related for NVD:CVE-2022-3916
osv2vulnrichment1github1redhatcve1veracode1cvelist1cve1prion1nessus6redhat10