PT-2022-10373

CVE-2021-3461

Published

2022-04-01

Updated

2022-04-13

Description by

CVSS 3.1

7.1

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified) Red Hat Single Sign-On (affected versions not specified)

Description A flaw was found in Keycloak where it may fail to logout a user session if the logout request comes from an external SAML identity provider and the Principal Type is set to Attribute [Name].

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Paramvir Jindal

Peter Mazán

Vendors

Affected products

Weakness enumeration

CWE-613: Insufficient Session Expiration

Related identifiers

CVE-2021-3461

GHSA-CM29-6WX7-P874