org.springframework.security.oauth CVEs

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5

2matches 1protected50.0% 1exploited50.0% 0CISA KEV0.0% 1public PoC50.0% 1EPSS ≥ 0.550.0%

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 1 50.0% No exploit published 0 0.0%

Critical 1 50.0% High 1 50.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 50.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

May 171 Mitigation candidate1 High1 not blocked1 Exploited1 Jun 170 Jul 170 Aug 170 Sep 170 Oct 170 Nov 170 Dec 170 Jan 180 Feb 180 Mar 180 Apr 180 May 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1

May 17Jul 17Sep 17Nov 17Jan 18Mar 18May 18

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2018-1260	Critical	2018-05-11	Protected by Waratek	No public exploit	Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
CVE-2016-4977	High	2017-05-25	Mitigation candidate	Exploited	When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2018-1260

Critical

2018-05-11

Protected by Waratek

No public exploit

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.

CVE-2016-4977

High

2017-05-25

Mitigation candidate

Exploited

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.