Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.
References
| Link | Resource |
|---|---|
| https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980 | Patch |
| https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h | Exploit Mitigation Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Oct 2023, 16:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Objectcomputing
Objectcomputing micronaut Security |
|
| CPE | cpe:2.3:a:objectcomputing:micronaut_security:3.11.0:*:*:*:*:*:*:* cpe:2.3:a:objectcomputing:micronaut_security:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980 - Patch | |
| References | (MISC) https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h - Exploit, Mitigation, Third Party Advisory |
09 Oct 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-09 14:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-36820
Mitre link : CVE-2023-36820
CVE.ORG link : CVE-2023-36820
JSON object : View
Products Affected
objectcomputing
- micronaut_security
CWE
CWE-284
Improper Access Control