Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2023-6236

Insufficient Verification of Data Authenticity

Published: Apr 10, 2024 | Modified: Nov 21, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
7.3 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Ubuntu
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-6236
CWEhttps://cwe.mitre.org/data/definitions/345.html

A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new provider-url option in addition to the realm option.

EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw.

Weakness

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Software

NameVendorStart VersionEnd Version
Red Hat JBoss Enterprise Application Platform 8RedHateap*
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8RedHateap8-elytron-web-0:4.0.1-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8RedHateap8-wildfly-elytron-0:2.2.4-2.SP01_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9RedHateap8-elytron-web-0:4.0.1-1.Final_redhat_00001.1.el9eap*
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9RedHateap8-wildfly-elytron-0:2.2.4-2.SP01_redhat_00001.1.el9eap*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use