CVE-2023-36820
micronaut security has invalid IdTokenClaimsValidator logic on aud
MEDIUM 6.5EPSS 0.5%
Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.
- Affected
- micronaut-projects · micronaut-security
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS v3.1 GITHUB
- 4.8 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.53% chance of exploitation in the next 30 days, 44th percentile
- Published
- 2023-10-09
- Updated
- 2024-09-19
Proof-of-concept exploits (2)
- micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h
- advisories/GHSA-qw22-8w9r-864h