GHSA-4v5x-9m47-cqr2

Suggest an improvement
Source
https://github.com/advisories/GHSA-4v5x-9m47-cqr2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4v5x-9m47-cqr2
Withdrawn
2025-03-25T21:48:41Z
Published
2024-12-09T21:31:02Z
Modified
2026-02-03T03:05:16Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5565-3c98-g6jc. This link is maintained to preserve external references.

Original Description

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

Database specific 
{
    "cwe_ids":  [
        "CWE-345"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-12-10T19:06:02Z",
    "nvd_published_at":  "2024-12-09T21:15:08Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.wildfly:wildfly-elytron-oidc-client-subsystem

Package

Name
org.wildfly:wildfly-elytron-oidc-client-subsystem
View open source insights on deps.dev
Purl
pkg:maven/org.wildfly/wildfly-elytron-oidc-client-subsystem

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
34.0.1.Final

Affected versions

25.*
25.0.0.Beta1
25.0.0.Final
25.0.1.Final
26.*
26.0.0.Beta1
26.0.0.Final
26.0.1.Final
26.1.0.Beta1
26.1.0.Final
26.1.1.Final
26.1.2.Final
26.1.3.Final
27.*
27.0.0.Alpha1
27.0.0.Alpha2
27.0.0.Alpha3
27.0.0.Alpha4
27.0.0.Alpha5
27.0.0.Beta1
27.0.0.Final
27.0.1.Final
28.*
28.0.0.Beta1
28.0.0.Final
28.0.1.Final
29.*
29.0.0.Alpha1
29.0.0.Beta1
29.0.0.Final
29.0.1.Final
30.*
30.0.0.Beta1
30.0.0.Final
30.0.1.Final
31.*
31.0.0.Beta1
31.0.0.Final
31.0.1.Final
32.*
32.0.0.Beta1
32.0.0.Final
32.0.1.Final
33.*
33.0.0.Beta1
33.0.0.Final
33.0.1.Final
33.0.2.Final
34.*
34.0.0.Beta1
34.0.0.Final
34.0.1.Final

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json"