CVE-2018-15758

CWE-269 — Improper Privilege ManagementCWE-2856 documents6 sources
Severity
8.1HIGH
EPSS
0.4%
top 40.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Pivotal Software Spring Security OauthPivotal Spring Security Oauth
Timeline
PublishedOct 18
Latest updateOct 25

Description

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom a…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NExploitability: 3.1 | Impact: 5.8

Affected Packages3 packages

▶CVEListV5pivotal/spring_security_oauth2.3 — 2.3.3+3

🔴Vulnerability Details

3
GHSA
Authorization bypass in org.springframework.security.oauth:spring-security-oauth2↗2018-10-19
▶
OSV
Authorization bypass in org.springframework.security.oauth:spring-security-oauth2↗2018-10-19
▶
CVEList
Privilege Escalation in spring-security-oauth2↗2018-10-18
▶

📋Vendor Advisories

1
Red Hat
spring-security-oauth: Privilege escalation by manipulating saved authorization request↗2018-10-16
▶

💬Community

1
Bugzilla
CVE-2018-15758 spring-security-oauth: Privilege escalation by manipulating saved authorization request↗2018-10-25
▶