CVE-2021-3461 — Insufficient Session Expiration in Redhat Keycloak

CWE-613 — Insufficient Session Expiration5 documents5 sources
Severity
7.1HIGHNVD
EPSS
0.1%
top 83.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat KeycloakRedhat Single Sign-on
Timeline
PublishedApr 1
Latest updateApr 3

Description

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5redhat/keycloakrh-sso7-keycloak 9.0.13
▶NVDredhat/keycloak9.0.13
▶NVDredhat/single_sign-on7.0, 7.4, 7.4.7+2

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
OSV
Keycloak insufficient session expiration↗2022-04-03
▶
GHSA
Keycloak insufficient session expiration↗2022-04-03
▶
CVEList
CVE-2021-3461: A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Princ↗2022-04-01
▶

📋Vendor Advisories

1
Red Hat
keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP↗2021-03-22
▶
CVE-2021-3461 — Insufficient Session Expiration | cvebase