PT-2024-40456 · Unknown · Zfr-Oauth2-Server-Module

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zfr-oauth2-server-module versions prior to 0.1.2

Description The issue concerns the validation and expiration of tokens. Prior to the specified version, tokens were not checked for validity or expiration, potentially leading to a security issue. If expired tokens were not deleted after their expiration time, it could allow unauthorized use of invalidated authentication credentials.

Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to ensure that tokens are properly checked for validity and expiration. As a temporary workaround, consider manually deleting expired tokens to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

GHSA-RCM4-JV5G-WCCM

Affected Products

Zfr-Oauth2-Server-Module

References · 6

• https://osv.dev/vulnerability/GHSA-rcm4-jv5g-wccm · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zfr/zfr-oauth2-server-module/2014-04-26.yaml · Note
• https://github.com/zf-fr/zfr-oauth2-server-module · Note
• https://github.com/zf-fr/zfr-oauth2-server-module/commit/2ca5bb1c2f11537be8f94ca6867d8d69789e744a · Note
• https://github.com/zf-fr/zfr-oauth2-server-module/tree/0.1.2 · Note
• https://github.com/zf-fr/zfr-oauth2-server-module/issues/6 · Note