GHSA-77rv-6vfw-x4gc

Source

https://github.com/advisories/GHSA-77rv-6vfw-x4gc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-77rv-6vfw-x4gc/GHSA-77rv-6vfw-x4gc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-77rv-6vfw-x4gc

Aliases

CVE-2019-3778

Published

2019-03-14T15:39:30Z

Modified

2024-02-16T08:19:08.896590Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability

Details

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.

A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint.

This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

Database specific

{
    "nvd_published_at": "2019-03-07T18:29:00Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:22:03Z"
}

References

Affected packages

Maven / org.springframework.security.oauth:spring-security-oauth

Package

Name: org.springframework.security.oauth:spring-security-oauth; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.17.RELEASE

Affected versions

1.*

1.0.0.RELEASE

1.0.1.RELEASE

1.0.2.RELEASE

1.0.3.RELEASE

1.0.4.RELEASE

1.0.5.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.0.7.RELEASE

2.0.8.RELEASE

2.0.9.RELEASE

2.0.10.RELEASE

2.0.11.RELEASE

2.0.12.RELEASE

2.0.13.RELEASE

2.0.14.RELEASE

2.0.15.RELEASE

2.0.16.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth2

Package

Name: org.springframework.security.oauth:spring-security-oauth2; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.17.RELEASE

Affected versions

1.*

1.0.0.RELEASE

1.0.1.RELEASE

1.0.2.RELEASE

1.0.3.RELEASE

1.0.4.RELEASE

1.0.5.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.0.7.RELEASE

2.0.8.RELEASE

2.0.9.RELEASE

2.0.10.RELEASE

2.0.11.RELEASE

2.0.12.RELEASE

2.0.13.RELEASE

2.0.14.RELEASE

2.0.15.RELEASE

2.0.16.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth

Package

Name: org.springframework.security.oauth:spring-security-oauth; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0.RELEASE

Fixed

2.1.4.RELEASE

Affected versions

2.*

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth2

Package

Name: org.springframework.security.oauth:spring-security-oauth2; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0.RELEASE

Fixed

2.1.4.RELEASE

Affected versions

2.*

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth

Package

Name: org.springframework.security.oauth:spring-security-oauth; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0.RELEASE

Fixed

2.2.4.RELEASE

Affected versions

2.*

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth2

Package

Name: org.springframework.security.oauth:spring-security-oauth2; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0.RELEASE

Fixed

2.2.4.RELEASE

Affected versions

2.*

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth

Package

Name: org.springframework.security.oauth:spring-security-oauth; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0.RELEASE

Fixed

2.3.5.RELEASE

Affected versions

2.*

2.3.0.RELEASE

2.3.1.RELEASE

2.3.2.RELEASE

2.3.3.RELEASE

2.3.4.RELEASE

Maven / org.springframework.security.oauth:spring-security-oauth2

Package

Name: org.springframework.security.oauth:spring-security-oauth2; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security.oauth/spring-security-oauth2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0.RELEASE

Fixed

2.3.5.RELEASE

Affected versions

2.*

2.3.0.RELEASE

2.3.1.RELEASE

2.3.2.RELEASE

2.3.3.RELEASE

2.3.4.RELEASE