Information disclosure in Dex - CVE-2022-39222

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way OAuth are handled during the OIDC flow. A remote attacker can trick the victim to navigate to a malicious website and guiding them through the OIDC flow, steal the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token.

Affected software

How to mitigate CVE-2022-39222

External References

• https://github.com/dexidp/dex/security/advisories/GHSA-vh7g-p26c-j2cw
• https://github.com/dexidp/dex/commit/49471b14c8080ddb034d4855841123d378b7a634

Related Security Bulletins

• Information disclosure in Dex
• Multiple vulnerabilities in Pivotal Concourse
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.3