CVE-2023-22492

Katalog CVE

CVSS 5.9 · Medium EPSS 0,60%

Kerentanan Insufficient Session Expiration pada zitadel. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4.

Rincian

Terbit di NVD

11 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83 patch · advisory pihak ketiga
• https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2 patch · advisory pihak ketiga
• https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8 patch · advisory pihak ketiga