mend-for-github-com[bot]
commented
1 year ago :information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2019-11269 - Medium Severity Vulnerability
Module for providing OAuth2 support to Spring Security
Library home page: http://static.springframework.org/spring-security/oauth
Path to dependency file: /commons/pac-api-commons/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/oauth/spring-security-oauth2/2.2.1.RELEASE/spring-security-oauth2-2.2.1.RELEASE.jar,/home/wss-scanner/.m2/repository/org/springframework/security/oauth/spring-security-oauth2/2.2.1.RELEASE/spring-security-oauth2-2.2.1.RELEASE.jar
Dependency Hierarchy: - spring-cloud-starter-security-2.0.0.RELEASE.jar (Root Library) - spring-cloud-security-2.0.0.RELEASE.jar - spring-security-oauth2-autoconfigure-2.0.0.RELEASE.jar - :x: **spring-security-oauth2-2.2.1.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: acf9a0620c1a37cee4f2896d71e1c3731c5c7b06
Found in base branch: master
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Publish Date: 2019-05-30
URL: CVE-2019-11269
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://pivotal.io/security/cve-2019-11269
Release Date: 2019-06-12
Fix Resolution (org.springframework.security.oauth:spring-security-oauth2): 2.2.5.RELEASE
Direct dependency fix Resolution (org.springframework.cloud:spring-cloud-starter-security): 2.1.0.RELEASE