Security Advisory WSO2-2022-2023¶
Published: June 15, 2023
Version: 1.0.0
Severity: Medium
CVSS Score: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- WWSO2 API Manager : 4.1.0 , 4.0.0 , 3.2.0 , 3.1.0 , 3.0.0
- WSO2 IS as Key Manager : 5.10.0 , 5.9.0
- WSO2 Identity Server : 5.11.0 , 5.10.0 , 5.9.0
OVERVIEW¶
Access tokens are not completely revoked from disabled/locked users when the user has the authorization to access multiple client applications.
DESCRIPTION¶
Due to the improper implementation of the token revocation function, the Access tokens are not completely revoked from the disabled/locked user when the user has the authorization to access multiple client applications.
IMPACT¶
This vulnerability only impacts for the disabled users. When disabling a user, some of the tokens of that user can be remaining without getting revoked.
SOLUTION¶
If the latest version of the affected WSO2 product is not mentioned under the affected product list, you may migrate to the latest version to receive security fixes. Otherwise you may apply the relevant fixes to the product based on the public fix:
Info
If you are a WSO2 customer with Support Subscription, please use WSO2 Updates in order to apply the fix.