| Vulnerability Name: | CVE-2019-11269 (CCN-162650) | ||||||||||||
| Assigned: | 2019-05-30 | ||||||||||||
| Published: | 2019-05-30 | ||||||||||||
| Updated: | 2021-01-30 | ||||||||||||
| Summary: | Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. | ||||||||||||
| CVSS v3 Severity: | 5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) 4.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
| ||||||||||||
| Vulnerability Type: | CWE-601 CWE-601 | ||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2019-11269 Source: MISC Type: Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html Source: XF Type: UNKNOWN spring-cve201911269-open-redirect(162650) Source: CCN Type: Packet Storm Security [06-13-2019] Spring Security OAuth 2.3 Open Redirection Source: CCN Type: Pivotal Web site CVE-2019-11269: Open Redirector in spring-security-oauth2 Source: CONFIRM Type: Vendor Advisory https://pivotal.io/security/cve-2019-11269 Source: CCN Type: Spring Web site Spring Security OAuth Source: CCN Type: IBM Security Bulletin 6320835 (Security Guardium Data Encryption) Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE) Source: CCN Type: IBM Security Bulletin 6347588 (Security Guardium) IBM Security Guardium is affected by multiple vulnerabilities Source: CCN Type: Oracle CPUJan2021 Oracle Critical Patch Update Advisory - January 2021 Source: MISC Type: Third Party Advisory https://www.oracle.com/security-alerts/cpujan2021.html | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||