CVE-2019-3778
published 2019-03-07CVE-2019-3778: Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions…
PriorityP353medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EXPLOIT
EPSS
15.62%
96.5th percentile
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apifest | oauth_2.0_server | — | — |
| oracle | banking_corporate_lending | — | — |
| oracle | banking_corporate_lending | — | — |
| oracle | banking_corporate_lending | — | — |
| pivotal_software | spring_security_oauth | >= 2.0.0 < 2.0.17 | 2.0.17 |
| pivotal_software | spring_security_oauth | >= 2.1.0 < 2.1.4 | 2.1.4 |
| pivotal_software | spring_security_oauth | >= 2.2.0 < 2.2.4 | 2.2.4 |
| pivotal_software | spring_security_oauth | >= 2.3.0 < 2.3.5 | 2.3.5 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hg6g-fgr6-h93g: ApiFest OAuth 2
ghsa_unreviewed·2022-06-30·CVSS 6.5
CVE-2020-26877 [MEDIUM] CWE-601 GHSA-hg6g-fgr6-h93g: ApiFest OAuth 2
ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it directly sends an authorization code to the redirect URI submitted with the authorization request, without checking whether the redirect URI is registered by the client who initiated the request. This allows an attacker to craft a request with a manipulated redirect URI (redirect_uri parameter), which is under the attacker's control, and consequently obtain the leaked authorization code when the server redirects the client to the manipulated redirect URI with an authorization code. NOTE: this is similar to CVE-2019-3778.
GHSA
spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
ghsa·2019-03-14
CVE-2019-3778 [MEDIUM] CWE-601 spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.
A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization
OSV
spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
osv·2019-03-14
CVE-2019-3778 [MEDIUM] spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.
A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization
Red Hat
spring-security-oauth2: Open redirect via the "redirect_uri" parameter
vendor_redhat·2019-02-21·CVSS 6.5
CVE-2019-3778 [MEDIUM] CWE-601 spring-security-oauth2: Open redirect via the "redirect_uri" parameter
spring-security-oauth2: Open redirect via the "redirect_uri" parameter
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server
No detection rules found.
http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.htmlhttp://www.securityfocus.com/bid/107153https://pivotal.io/security/cve-2019-3778https://www.oracle.com/security-alerts/cpujan2021.htmlhttp://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.htmlhttp://www.securityfocus.com/bid/107153https://pivotal.io/security/cve-2019-3778https://www.oracle.com/security-alerts/cpujan2021.html
2019-03-07
Published