The vulnerability of the OAuth component in the Java framework for securing Spring-based industrial applications allows attackers to escalate their privileges and gain unauthorized access to protected information.

🗓️ 16 Feb 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

OAuth component in the Java Spring framework redirects to insecure URLs, allowing privilege escalation and unauthorized data access.

Reporter	Title	Published	Views	Family All 25
0day.today	Spring Security OAuth - Open Redirector Vulnerability	18 Jun 201900:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	13 Apr 202120:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Remote code execution vulnerability (CVE-2019-3778) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1	18 Jun 201908:15	–	ibm
Circl	CVE-2019-3778	29 Jun 202218:43	–	circl
CVE	CVE-2019-3778	7 Mar 201919:00	–	cve
Cvelist	CVE-2019-3778 Open Redirect in spring-security-oauth2	7 Mar 201919:00	–	cvelist
Exploit DB	Spring Security OAuth - Open Redirector	17 Jun 201900:00	–	exploitdb
exploitpack	Spring Security OAuth - Open Redirector	17 Jun 201900:00	–	exploitpack
Github Security Blog	spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability	14 Mar 201915:39	–	github

Vulners

Node

oracle oracle_flexcube_universal_bankingRange14.0.0–14.4.0

OR

oracle oracle_banking_liquidity_managementRange14.0.0–14.4.0

OR

oracle oracle_banking_credit_facilities_process_managementMatch14.1.0

OR

oracle oracle_banking_credit_facilities_process_managementMatch14.3.0

OR

oracle oracle_banking_credit_facilities_process_managementMatch14.4.0

OR

oracle oracle_banking_paymentsMatch14.4.0

OR

oracle oracle_banking_supply_chain_financeRange14.2.0–14.4.0

OR

oracle oracle_banking_trade_finance_process_managementMatch14.1.0

OR

oracle oracle_banking_trade_finance_process_managementMatch14.3.0

OR

oracle oracle_banking_trade_finance_process_managementMatch14.4.0

OR

oracle oracle_banking_virtual_account_managementMatch14.1.0

OR

oracle oracle_banking_virtual_account_managementMatch14.3.0

OR

oracle oracle_banking_virtual_account_managementMatch14.4.0

OR

broadcom spring_securityRange2.0.0–2.0.17

OR

broadcom spring_securityRange2.1.0–2.1.4

OR

broadcom spring_securityRange2.2.0–2.2.4

OR

broadcom spring_securityRange2.3.0–2.3.5

OR

oracle oracle_banking_corporate_lending_process_managementMatch14.1.0

OR

oracle oracle_banking_corporate_lending_process_managementMatch14.3.0

OR

oracle oracle_banking_corporate_lending_process_managementMatch14.4.0

Source	Link
oracle	www.oracle.com/security-alerts/cpujan2021.html
pivotal	www.pivotal.io/security/cve-2019-3778
web	www.web.nvd.nist.gov/view/vuln/detail

16 Feb 2021 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 26.4

CVSS 36.5

EPSS0.15621

authorization protocol insecure redirects privilege escalation unauthorized access spring framework industrial applications