Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/104158 | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2018:1809 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2939 | Third Party Advisory |
| https://pivotal.io/security/cve-2018-1260 | Vendor Advisory |
| http://www.securityfocus.com/bid/104158 | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2018:1809 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2939 | Third Party Advisory |
| https://pivotal.io/security/cve-2018-1260 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/104158 - Third Party Advisory, VDB Entry | |
| References | () https://access.redhat.com/errata/RHSA-2018:1809 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2018:2939 - Third Party Advisory | |
| References | () https://pivotal.io/security/cve-2018-1260 - Vendor Advisory |
Information
Published : 2018-05-11 20:29
Updated : 2024-11-21 03:59
NVD link : CVE-2018-1260
Mitre link : CVE-2018-1260
CVE.ORG link : CVE-2018-1260
JSON object : View
Products Affected
pivotal_software
- spring_security_oauth
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')