CVSS: 5.8EPSS: 0%CPEs: 7EXPL: 1CVE-2019-11269 – Open Redirector in spring-security-oauth2
https://notcve.org/view.php?id=CVE-2019-11269
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. Spring Security OAuth versiones 2.3 anteriores a 2.3.6, 2.2 anteriores a 2.2.5, 2.1 anteriores a 2.1.5 y 2.0 anteriores a 2.0.18, así como versiones anteriores no compatibles podrían ser susceptibles a un ataque de redirector abierto que pueda filtrar un código de autorización. Un usuario o atacante malicioso puede crear una solicitud para el punto final de autorización utilizando el tipo de concesión de código de autorización y especificar un URI de redireccionamiento manipulado a través del parámetro redirect_uri. • https://www.exploit-db.com/exploits/47000 http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html https://pivotal.io/security/cve-2019-11269 https://www.oracle.com/security-alerts/cpujan2021.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 2CVE-2019-3778 – Open Redirect in spring-security-oauth2
https://notcve.org/view.php?id=CVE-2019-3778
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. • https://www.exploit-db.com/exploits/47000 https://github.com/BBB-man/CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html http://www.securityfocus.com/bid/107153 https://pivotal.io/security/cve-2019-3778 https://www.oracle.com/security-alerts/cpujan2021.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.6EPSS: 0%CPEs: 5EXPL: 0CVE-2018-15758 – Privilege Escalation in spring-security-oauth2
https://notcve.org/view.php?id=CVE-2018-15758
Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. • http://www.securityfocus.com/bid/105687 https://access.redhat.com/errata/RHSA-2019:2413 https://pivotal.io/security/cve-2018-15758 https://access.redhat.com/security/cve/CVE-2018-15758 https://bugzilla.redhat.com/show_bug.cgi?id=1643048 • CWE-285: Improper Authorization •
CVSS: 9.8EPSS: 4%CPEs: 4EXPL: 0CVE-2018-1260 – spring-security-oauth: remote code execution in the authorization process
https://notcve.org/view.php?id=CVE-2018-1260
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint. Spring Security OAuth, en versiones 2.3 anteriores a la 2.3.3, versiones 2.2 anteriores a la 2.2.2, versiones 2.1 anteriores a la 2.1.2, versiones 2.0 anteriores a la 2.0.15 y versiones anteriores no soportadas, contiene una vulnerabilidad de ejecución remota de código. Un usuario o atacante malicioso puede manipular una petición de autorización al endpoint de autorización que puede conducir a la ejecución remota de código cuando el propietario del recurso se reenvía al endpoint de aprobación. • http://www.securityfocus.com/bid/104158 https://access.redhat.com/errata/RHSA-2018:1809 https://access.redhat.com/errata/RHSA-2018:2939 https://pivotal.io/security/cve-2018-1260 https://access.redhat.com/security/cve/CVE-2018-1260 https://bugzilla.redhat.com/show_bug.cgi?id=1584376 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 8.8EPSS: 3%CPEs: 16EXPL: 1CVE-2016-4977
https://notcve.org/view.php?id=CVE-2016-4977
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type. Cuando se procesan las peticiones de autorización usando las vistas whitelabel en Spring Security OAuth versiones 2.0.0 hasta 2.0.9 y versiones 1.0.0 hasta 1.0.5, el valor del parámetro response_type fue ejecutado como Spring SpEL, lo que habilitó a un usuario malicioso desencadenar la ejecución de código remota por medio del diseño del valor para response_type. • https://github.com/N0b1e6/CVE-2016-4977-POC http://www.openwall.com/lists/oss-security/2019/10/16/1 https://lists.apache.org/thread.html/0841d849c23418c473ccb9183cbf41a317cb0476e44be48022ce3488%40%3Cdev.fineract.apache.org%3E https://lists.apache.org/thread.html/37d7e820fc65a768de3e096e98382d5529a52a039f093e59357d0bc0%40%3Cdev.fineract.apache.org%3E https://lists.apache.org/thread.html/5e6dd946635bbcc9e1f2591599ad0fab54f2dc3714196af3b17893f2%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/96c017115069408cec5e82ce1e6293facab398011f6db7e1befbe274% • CWE-19: Data Processing Errors •