Exposure of Data Element to Wrong Session Affecting org.keycloak:keycloak-services package, versions [0,20.0.2)
Threat Intelligence
EPSS
0.09% (38th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-3168650
- published 14 Dec 2022
- disclosed 13 Dec 2022
- credit Unknown
Introduced: 13 Dec 2022
CVE-2022-3916 Open this link in a new tabHow to fix?
Upgrade org.keycloak:keycloak-services to version 20.0.2 or higher.
Overview
org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.
Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session when using a client with the offline_access scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.
References
CVSS Scores
version 3.1