CVE Vulnerabilities

CVE-2021-3461

Insufficient Session Expiration

Published: Apr 01, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.1
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.x
3.3 LOW
AV:L/AC:M/Au:N/C:P/I:P/A:N
RedHat/V2
RedHat/V3
7.1 MODERATE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Ubuntu

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

Weakness

According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”

Affected Software

Name Vendor Start Version End Version
Keycloak Redhat 9.0.13 (including) 9.0.13 (including)
Red Hat Single Sign-On 7.4.7 RedHat keycloak *
Red Hat Single Sign-On 7.4 for RHEL 6 RedHat rh-sso7-keycloak-0:9.0.13-1.redhat_00006.1.el6sso *
Red Hat Single Sign-On 7.4 for RHEL 7 RedHat rh-sso7-keycloak-0:9.0.13-1.redhat_00006.1.el7sso *
Red Hat Single Sign-On 7.4 for RHEL 8 RedHat rh-sso7-keycloak-0:9.0.13-1.redhat_00006.1.el8sso *

Potential Mitigations

References