GitHub Advisoryadvisory · Maven

GHSA-7q9c-h23x-65fq Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views

HIGH Published 2018-10-18 Modified 2024-05-14 Official page ↗
Aliases
CVE-2016-4977
Ecosystem
Maven
Packages
org.springframework.security.oauth:spring-security-oauth2
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.security.oauth:spring-security-oauth2: >= 2.0.0, < 2.0.10 → fixed in 2.0.10 • Maven org.springframework.security.oauth:spring-security-oauth2: >= 1.0.0, < 1.0.5 → fixed in 1.0.5

Description

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

Related

Alias · CVE (1)

  • CVE-2016-4977 When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the… vulnerability

References