PT-2023-13036 · Okta · Okta Oidc Middleware

Jviding · Published 2023-01-09 · Updated 2025-04-08 · CVE-2022-3145

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Okta OIDC Middleware versions prior to 5.0.0

Description An open redirect issue exists, allowing an attacker to redirect a user to an arbitrary URL. To exploit this, an attacker would need to send a victim a malformed URL containing a target server that they control. Once a user successfully completed the login process, the victim user would then be redirected to the attacker-controlled site.

Recommendations For Okta OIDC Middleware versions prior to 5.0.0, upgrade to version 5.0.0 or later to remediate this issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-3145

GHSA-58H4-9M7M-J9M4

Affected Products

Okta Oidc Middleware

References · 10

• https://osv.dev/vulnerability/CVE-2022-3145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-58h4-9m7m-j9m4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3145 · Security Note
• https://github.com/okta/okta-oidc-middleware/commit/5d10b3ccdd5d6893de4d8b58696094267d30c113 · Note
• https://github.com/okta/okta-oidc-middleware · Note
• https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4 · Note
• https://t.me/cvenotify/43090 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3145 · Note
• https://t.me/cibsecurity/56449 · Telegram Post
• https://t.me/cvenotify/118194 · Telegram Post