Remote Code Execution (RCE)

2018-05-1006:42:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.047 Low

EPSS

Percentile

92.7%

JSON

spring-security-oauth2 is vulnerable to remote code execution (RCE) attacks. The vulnerability occurs when a malicious user can insert an RCE payload into an authorization request to the authroization endpoint, and is executed when the resource owner is forwarded to the approval endpoint. This vulnerability only affects applications that contains the role of an Authorization Server, and the use of the default Approval Endpoint.

CPENameOperatorVersion
oauth2 for spring securityle1.0.5.RELEASE
oauth2 for spring securityle2.2.1.RELEASE
oauth2 for spring securityle2.3.2.RELEASE
oauth2 for spring securityle2.1.1.RELEASE
oauth2 for spring securityle2.0.14.RELEASE

Name	Operator	Version
oauth2 for spring security	le	1.0.5.RELEASE
oauth2 for spring security	le	2.2.1.RELEASE
oauth2 for spring security	le	2.3.2.RELEASE
oauth2 for spring security	le	2.1.1.RELEASE
oauth2 for spring security	le	2.0.14.RELEASE