Description
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- WSO2 / Forgerock Key Manager Component1.0.0 – 1.0.0.4
- WSO2 / Forgerock Key Manager Component1.1.0 – 1.1.0.2
- WSO2 / Forgerock Key Manager Component1.1.5 – 1.1.5.3
- WSO2 / Forgerock Key Manager Component1.1.5 – 1.1.5.4
- WSO2 / Forgerock Key Manager Component1.0.0 – 1.0.0.3
- WSO2 / WSO2 API Control Plane4.5.0 – 4.5.0.15
- WSO2 / WSO2 API Control Plane0 – 4.5.0
- WSO2 / WSO2 API Manager4.5.0 – 4.5.0.14
- WSO2 / WSO2 API Manager0 – 3.2.0
- WSO2 / WSO2 API Manager3.2.0 – 3.2.0.434
- WSO2 / WSO2 API Manager3.2.1 – 3.2.1.54
- WSO2 / WSO2 API Manager4.1.0 – 4.1.0.218
- WSO2 / WSO2 API Manager4.2.0 – 4.2.0.156
- WSO2 / WSO2 API Manager4.3.0 – 4.3.0.67
- WSO2 / WSO2 API Manager4.4.0 – 4.4.0.30
- WSO2 / WSO2 Universal Gateway4.5.0 – 4.5.0.14
- WSO2 / WSO2 Universal Gateway0 – 4.5.0
Updated 44m ago · 8 sources