PT-2023-13036 · Okta · Okta Oidc Middleware

Jviding · Publicado 2023-01-09 · Atualizado 2025-04-08 · CVE-2022-3145

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Okta OIDC Middleware versions prior to 5.0.0

Description An open redirect issue exists, allowing an attacker to redirect a user to an arbitrary URL. To exploit this, an attacker would need to send a victim a malformed URL containing a target server that they control. Once a user successfully completed the login process, the victim user would then be redirected to the attacker-controlled site.

Recommendations For Okta OIDC Middleware versions prior to 5.0.0, upgrade to version 5.0.0 or later to remediate this issue.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2022-3145

GHSA-58H4-9M7M-J9M4

Produtos afetados

Okta Oidc Middleware

Referências · 10

• https://github.com/okta/okta-oidc-middleware/commit/5d10b3ccdd5d6893de4d8b58696094267d30c113 · Nota
• https://github.com/okta/okta-oidc-middleware · Nota
• https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4 · Nota
• https://t.me/cvenotify/43090 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-3145 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3145 · Nota
• https://osv.dev/vulnerability/GHSA-58h4-9m7m-j9m4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-3145 · Nota de Segurança
• https://t.me/cibsecurity/56449 · Publicação no Telegram
• https://t.me/cvenotify/118194 · Publicação no Telegram