CVE-2023-6236

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-62375.9Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function E CVE-2023-62386.7A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small m CVE-2023-62398.8Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of CVE-2023-62406.5A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network at CVE-2023-62417.0Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm CVE-2023-62424.3The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to CVE-2023-62434.3The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u CVE-2023-62444.3The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to CVE-2023-62457.5The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payloa CVE-2023-62467.8A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vs CVE-2023-62476.5The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the appl CVE-2023-62489.8The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attac