GitHub Advisoryadvisory · Maven

GHSA-8p36-q63g-68qh Autobinding vulnerability in MITREid Connect

CRITICAL Published 2021-05-13 Modified 2022-12-03 Official page ↗
Aliases
CVE-2021-27582
Ecosystem
Maven
Packages
org.mitre:openid-connect-parent
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-05-07

Affected packages

• Maven org.mitre:openid-connect-parent: <= 1.3.3 (no fix yet)

Description

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.

Related

Alias · CVE (1)

  • CVE-2021-27582 org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References