Insufficient Verification Of Data Authenticity

2024-04-1509:37:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

wildfly-elytron-http-oidc

oidc

session token caching

multiple tenants

realm option

data authenticity

vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.7

Confidence

Low

EPSS

Percentile

15.5%

JSON

org.wildfly.security:wildfly-elytron-http-oidc is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to the session token caching logic when an OIDC app serving multiple tenants accesses a new tenant with a different OIDC configuration. This flaw occurs in OidcSessionTokenStore, where the decision to reuse a cached token does not properly consider the “provider-url” along with the “realm” option.