Improper Authorization in JBoss Enterprise Application Platform - CVE-2023-6236

Vulnerability identifier: #VU92281

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6236

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass certain security restrictions.

The vulnerability exists in the OidcSessionTokenStore when determining if a cached token should be used or not. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. A remote user can gain unauthorized access to the second tenant.

JBoss Enterprise Application Platform
IBM Business Automation Manager Open Editions
eap8-jose4j (Red Hat package)
eap8-guava-failureaccess (Red Hat package)
eap8-amazon-ion-java (Red Hat package)
eap8-reactive-streams (Red Hat package)
eap8-fge-msg-simple (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-log4j2-jboss-logmanager (Red Hat package)
eap8-jakarta-json (Red Hat package)
eap8-fge-btf (Red Hat package)
eap8-java-classmate (Red Hat package)
eap8-wsdl4j (Red Hat package)
eap8-jasypt (Red Hat package)
eap8-apache-commons-beanutils (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-angus-activation (Red Hat package)
eap8-atinject (Red Hat package)
eap8-jakarta-transaction-api (Red Hat package)
eap8-jgroups-kubernetes (Red Hat package)
eap8-angus (Red Hat package)
eap8-wildfly-http-client (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-jakarta-interceptor-api (Red Hat package)
eap8-jakarta-batch-api (Red Hat package)
eap8-jakarta-annotation-api (Red Hat package)
eap8-jakarta-mail (Red Hat package)
eap8-jakarta-activation (Red Hat package)
eap8-jakarta-json-api (Red Hat package)
eap8-jberet (Red Hat package)
eap8-jboss-modules (Red Hat package)
eap8-wildfly-elytron (Red Hat package)
eap8-ws-commons-XmlSchema (Red Hat package)
eap8-velocity (Red Hat package)
eap8-gson (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-apache-sshd (Red Hat package)
eap8-joda-time (Red Hat package)
eap8-jackson-databind (Red Hat package)
eap8-jackson-dataformats-binary (Red Hat package)
eap8-jackson-jaxrs-providers (Red Hat package)
eap8-jackson-modules-base (Red Hat package)
eap8-jackson-modules-java8 (Red Hat package)
eap8-jackson-annotations (Red Hat package)
eap8-jackson-core (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-wss4j (Red Hat package)
eap8-jakarta-validation-api (Red Hat package)
eap8-yasson (Red Hat package)
eap8-wildfly-transaction-client (Red Hat package)
eap8-ironjacamar (Red Hat package)
eap8-javaee-jpa-spec (Red Hat package)
eap8-jakarta-ws-rs-api (Red Hat package)
eap8-jakarta-jms-api (Red Hat package)
eap8-caffeine (Red Hat package)
eap8-hal-console (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-jakarta-xml-bind-api (Red Hat package)
eap8-elytron-web (Red Hat package)
eap8-jaxb (Red Hat package)
eap8-sun-istack-commons (Red Hat package)
eap8-httpcomponents-asyncclient (Red Hat package)
eap8-netty (Red Hat package)
eap8-netty-transport-native-epoll (Red Hat package)
eap8-stax2-api (Red Hat package)
eap8-httpcomponents-core (Red Hat package)
eap8-httpcomponents-client (Red Hat package)
eap8-protostream (Red Hat package)
eap8-antlr4 (Red Hat package)
eap8-jboss-ejb-client (Red Hat package)
eap8-jgroups (Red Hat package)
eap8-jakarta-servlet-api (Red Hat package)
eap8-narayana (Red Hat package)
eap8-hibernate-search (Red Hat package)
eap8-resteasy (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-woodstox-core (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-lucene-solr (Red Hat package)
eap8-infinispan (Red Hat package)
eap8-guava-libraries (Red Hat package)

Install updates from vendor's website.

JBoss Enterprise Application Platform - update to 8.0.2
IBM Business Automation Manager Open Editions - update to 8.0.7
eap8-jose4j (Red Hat package) - addressed in versions 0.9.3-2.redhat_00004.1.el8eap, 0.9.3-2.redhat_00004.1.el9eap
eap8-guava-failureaccess (Red Hat package) - addressed in versions 1.0.1-4.redhat_00012.1.el8eap, 1.0.1-4.redhat_00012.1.el9eap
eap8-amazon-ion-java (Red Hat package) - addressed in versions 1.0.2-4.redhat_00005.1.el8eap, 1.0.2-4.redhat_00005.1.el9eap
eap8-reactive-streams (Red Hat package) - addressed in versions 1.0.4-2.redhat_00003.1.el8eap, 1.0.4-2.redhat_00003.1.el9eap
eap8-fge-msg-simple (Red Hat package) - addressed in versions 1.1.0-2.redhat_00015.1.el8eap, 1.1.0-2.redhat_00015.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap8-log4j2-jboss-logmanager (Red Hat package) - addressed in versions 1.1.2-1.Final_redhat_00002.1.el8eap, 1.1.2-1.Final_redhat_00002.1.el9eap
eap8-jakarta-json (Red Hat package) - addressed in versions 1.1.6-4.redhat_00003.1.el8eap, 1.1.6-4.redhat_00003.1.el9eap
eap8-fge-btf (Red Hat package) - addressed in versions 1.2.0-2.redhat_00017.1.el8eap, 1.2.0-2.redhat_00017.1.el9eap
eap8-java-classmate (Red Hat package) - addressed in versions 1.5.1-2.redhat_00003.1.el8eap, 1.5.1-2.redhat_00003.1.el9eap
eap8-wsdl4j (Red Hat package) - addressed in versions 1.6.3-4.redhat_00007.1.el8eap, 1.6.3-4.redhat_00007.1.el9eap
eap8-jasypt (Red Hat package) - addressed in versions 1.9.3-3.redhat_00003.1.el8eap, 1.9.3-3.redhat_00003.1.el9eap
eap8-apache-commons-beanutils (Red Hat package) - addressed in versions 1.9.4-12.redhat_00003.1.el8eap, 1.9.4-12.redhat_00003.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.15.0-5.redhat_00015.1.el8eap, 1.15.0-5.redhat_00015.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.0.0-2.redhat_00012.1.el8eap, 2.0.0-2.redhat_00012.1.el9eap
eap8-angus-activation (Red Hat package) - addressed in versions 2.0.1-2.redhat_00005.1.el8eap, 2.0.1-2.redhat_00005.1.el9eap
eap8-atinject (Red Hat package) - addressed in versions 2.0.1-2.redhat_00005.1.el8eap, 2.0.1-2.redhat_00005.1.el9eap
eap8-jakarta-transaction-api (Red Hat package) - addressed in versions 2.0.1-3.redhat_00004.1.el8eap, 2.0.1-3.redhat_00004.1.el9eap
eap8-jgroups-kubernetes (Red Hat package) - addressed in versions 2.0.2-1.Final_redhat_00001.1.el8eap, 2.0.2-1.Final_redhat_00001.1.el9eap
eap8-angus (Red Hat package) - addressed in versions 2.0.2-3.redhat_00002.1.el8eap, 2.0.2-3.redhat_00002.1.el9eap
eap8-wildfly-http-client (Red Hat package) - addressed in versions 2.0.7-1.Final_redhat_00001.1.el8eap, 2.0.7-1.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.7-3.redhat_00003.1.el8eap, 2.0.7-3.redhat_00003.1.el9eap
eap8-jakarta-interceptor-api (Red Hat package) - addressed in versions 2.1.0-4.redhat_00002.1.el8eap, 2.1.0-4.redhat_00002.1.el9eap
eap8-jakarta-batch-api (Red Hat package) - addressed in versions 2.1.1-3.redhat_00003.1.el8eap, 2.1.1-3.redhat_00003.1.el9eap
eap8-jakarta-annotation-api (Red Hat package) - addressed in versions 2.1.1-4.redhat_00003.1.el8eap, 2.1.1-4.redhat_00003.1.el9eap
eap8-jakarta-mail (Red Hat package) - addressed in versions 2.1.2-2.redhat_00003.1.el8eap, 2.1.2-2.redhat_00003.1.el9eap
eap8-jakarta-activation (Red Hat package) - addressed in versions 2.1.2-2.redhat_00005.1.el8eap, 2.1.2-2.redhat_00005.1.el9eap
eap8-jakarta-json-api (Red Hat package) - addressed in versions 2.1.2-3.redhat_00003.1.el8eap, 2.1.2-3.redhat_00003.1.el9eap
eap8-jberet (Red Hat package) - addressed in versions 2.1.4-1.Final_redhat_00001.1.el8eap, 2.1.4-1.Final_redhat_00001.1.el9eap
eap8-jboss-modules (Red Hat package) - addressed in versions 2.1.4-2.Final_redhat_00001.1.el8eap, 2.1.4-2.Final_redhat_00001.1.el9eap
eap8-wildfly-elytron (Red Hat package) - addressed in versions 2.2.4-2.SP01_redhat_00001.1.el8eap, 2.2.4-2.SP01_redhat_00001.1.el9eap
eap8-ws-commons-XmlSchema (Red Hat package) - addressed in versions 2.3.0-2.redhat_00002.1.el8eap, 2.3.0-2.redhat_00002.1.el9eap
eap8-velocity (Red Hat package) - addressed in versions 2.3.0-2.redhat_00008.1.el8eap, 2.3.0-2.redhat_00008.1.el9eap
eap8-gson (Red Hat package) - addressed in versions 2.8.9-2.redhat_00002.1.el8eap, 2.8.9-2.redhat_00002.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.11.0-2.redhat_00003.1.el8eap, 2.11.0-2.redhat_00003.1.el9eap
eap8-apache-sshd (Red Hat package) - addressed in versions 2.12.1-1.redhat_00001.1.el8eap, 2.12.1-1.redhat_00001.1.el9eap
eap8-joda-time (Red Hat package) - addressed in versions 2.12.5-1.redhat_00001.1.el8eap, 2.12.5-1.redhat_00001.1.el9eap
eap8-jackson-databind (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-dataformats-binary (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-modules-base (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-modules-java8 (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-annotations (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-jackson-core (Red Hat package) - addressed in versions 2.15.4-1.redhat_00001.1.el8eap, 2.15.4-1.redhat_00001.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.21.0-4.redhat_00048.1.el8eap, 2.21.0-4.redhat_00048.1.el9eap
eap8-wss4j (Red Hat package) - addressed in versions 3.0.1-2.redhat_00014.1.el8eap, 3.0.1-2.redhat_00014.1.el9eap
eap8-jakarta-validation-api (Red Hat package) - addressed in versions 3.0.2-2.redhat_00005.1.el8eap, 3.0.2-2.redhat_00005.1.el9eap
eap8-yasson (Red Hat package) - addressed in versions 3.0.3-2.redhat_00001.1.el8eap, 3.0.3-2.redhat_00001.1.el9eap
eap8-wildfly-transaction-client (Red Hat package) - addressed in versions 3.0.5-1.Final_redhat_00001.1.el8eap, 3.0.5-1.Final_redhat_00001.1.el9eap
eap8-ironjacamar (Red Hat package) - addressed in versions 3.0.8-1.Final_redhat_00001.1.el8eap, 3.0.8-1.Final_redhat_00001.1.el9eap
eap8-javaee-jpa-spec (Red Hat package) - addressed in versions 3.1.0-3.redhat_00002.1.el8eap, 3.1.0-3.redhat_00002.1.el9eap
eap8-jakarta-ws-rs-api (Red Hat package) - addressed in versions 3.1.0-4.redhat_00002.1.el8eap, 3.1.0-4.redhat_00002.1.el9eap
eap8-jakarta-jms-api (Red Hat package) - addressed in versions 3.1.0-4.redhat_00003.1.el8eap, 3.1.0-4.redhat_00003.1.el9eap
eap8-caffeine (Red Hat package) - addressed in versions 3.1.8-1.redhat_00001.1.el8eap, 3.1.8-1.redhat_00001.1.el9eap
eap8-hal-console (Red Hat package) - addressed in versions 3.6.18-1.Final_redhat_00001.1.el8eap, 3.6.18-1.Final_redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.0-2.redhat_00002.1.el8eap, 4.0.0-2.redhat_00002.1.el9eap
eap8-jakarta-xml-bind-api (Red Hat package) - addressed in versions 4.0.0-4.redhat_00009.1.el8eap, 4.0.0-4.redhat_00009.1.el9eap
eap8-elytron-web (Red Hat package) - addressed in versions 4.0.1-1.Final_redhat_00001.1.el8eap, 4.0.1-1.Final_redhat_00001.1.el9eap
eap8-jaxb (Red Hat package) - addressed in versions 4.0.2-4.redhat_00001.1.el8eap, 4.0.2-4.redhat_00001.1.el9eap
eap8-sun-istack-commons (Red Hat package) - addressed in versions 4.1.2-1.redhat_00003.1.el8eap, 4.1.2-1.redhat_00003.1.el9eap
eap8-httpcomponents-asyncclient (Red Hat package) - addressed in versions 4.1.5-2.redhat_00004.1.el8eap, 4.1.5-2.redhat_00004.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.100-2.Final_redhat_00001.1.el8eap, 4.1.100-2.Final_redhat_00001.1.el9eap
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.100-5.Final_redhat_00001.1.el8eap, 4.1.100-5.Final_redhat_00001.1.el9eap
eap8-stax2-api (Red Hat package) - addressed in versions 4.2.1-2.redhat_00008.1.el8eap, 4.2.1-2.redhat_00008.1.el9eap
eap8-httpcomponents-core (Red Hat package) - addressed in versions 4.4.16-2.redhat_00008.1.el8eap, 4.4.16-2.redhat_00008.1.el9eap
eap8-httpcomponents-client (Red Hat package) - addressed in versions 4.5.14-2.redhat_00010.1.el8eap, 4.5.14-2.redhat_00010.1.el9eap
eap8-protostream (Red Hat package) - addressed in versions 4.6.5-4.Final_redhat_00006.1.el8eap, 4.6.5-4.Final_redhat_00006.1.el9eap
eap8-antlr4 (Red Hat package) - addressed in versions 4.10.1-1.redhat_00001.1.el8eap, 4.10.1-1.redhat_00001.1.el9eap
eap8-jboss-ejb-client (Red Hat package) - addressed in versions 5.0.6-1.Final_redhat_00001.1.el8eap, 5.0.6-1.Final_redhat_00001.1.el9eap
eap8-jgroups (Red Hat package) - addressed in versions 5.2.23-1.Final_redhat_00001.1.el8eap, 5.2.23-1.Final_redhat_00001.1.el9eap
eap8-jakarta-servlet-api (Red Hat package) - addressed in versions 6.0.0-4.redhat_00005.1.el8eap, 6.0.0-4.redhat_00005.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.2-1.Final_redhat_00002.1.el8eap, 6.0.2-1.Final_redhat_00002.1.el9eap
eap8-hibernate-search (Red Hat package) - addressed in versions 6.2.2-1.Final_redhat_00001.1.el8eap, 6.2.2-1.Final_redhat_00001.1.el9eap
eap8-resteasy (Red Hat package) - addressed in versions 6.2.7-1.Final_redhat_00001.1.el8eap, 6.2.7-1.Final_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.18-1.Final_redhat_00001.1.el8eap, 6.2.18-1.Final_redhat_00001.1.el9eap
eap8-woodstox-core (Red Hat package) - addressed in versions 6.4.0-2.redhat_00002.1.el8eap, 6.4.0-2.redhat_00002.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-1.Final_redhat_00001.1.el8eap, 8.0.1-1.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.2-2.GA_redhat_00009.1.el8eap, 8.0.2-2.GA_redhat_00009.1.el9eap
eap8-lucene-solr (Red Hat package) - addressed in versions 8.11.3-1.redhat_00001.1.el8eap, 8.11.3-1.redhat_00001.1.el9eap
eap8-infinispan (Red Hat package) - addressed in versions 14.0.24-1.Final_redhat_00001.1.el8eap, 14.0.24-1.Final_redhat_00001.1.el9eap
eap8-guava-libraries (Red Hat package) - addressed in versions 32.1.2-1.jre_redhat_00001.1.el8eap, 32.1.2-1.jre_redhat_00001.1.el9eap

• https://access.redhat.com/security/cve/CVE-2023-6236
• https://bugzilla.redhat.com/show_bug.cgi?id=2250812
• https://access.redhat.com/errata/RHSA-2024:3580
• https://access.redhat.com/errata/RHSA-2024:3581
• https://access.redhat.com/errata/RHSA-2024:3583

• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions