Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:43557
HistoryOct 06, 2023 - 7:41 a.m.

Insecure Session Cookie Handling

2023-10-0607:41:57
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
quarkus-oidc
vulnerability
insecure session cookie
oidc
access tokens
authorization code flow
http protocol
attacker
sensitive user data
oidc provider services.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

30.6%

quarkus-oidc is vulnerable to Insecure OIDC Session Cookie Handling. The vulnerability exists because the library does not properly encrypt the OIDC session cookie value by default which leads to the leakage of both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, allowing an attacker to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

30.6%