br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +57 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +85 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2018-15758 Source advisory: OSV:GHSA-H8W4-QV99-F...

Privilege Escalation

spring-security-oauth2 is vulnerable to privilege escalation. The library does not properly handle the AuthorizationRequest parameter state, allowing a malicious user to pass a request to an approval endpoint and modify a previous authorization request, leading to a privilege escalation...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +57 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +85 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2018-15758 Source advisory: MEND:CVE-2018-15758...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

br.com.damsete.arq:damsete-arq (>=0.0.1, <=0.0.3), br.com.damsete.arq:damsete-arq-audit (>=0.0.1, <=0.0.3) +14 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.1.release, =4.0.0, =0.1.0, =4.26.0, =4.26.0, =3.3.0.6, =4.30.0 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

br.com.damsete.arq:damsete-arq (>=0.0.1, <=0.0.3), br.com.damsete.arq:damsete-arq-audit (>=0.0.1, <=0.0.3) +14 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.1.release, =4.0.0, =0.1.0, =4.26.0, =4.26.0, =3.3.0.6, =4.30.0 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

br.com.anteros:anteros-keycloak (1.0.0), com.blossom-project:blossom-starter-ui-api (>=1.0.0.m2, <=1.1.1) +47 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =1.0.6, =1.0.0, =0.7.4, =0.7.8 - com.vmware.card-connectors:airwatch-connector 2.1 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +12 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.1.3, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =1.3.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +12 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.1.3, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =1.3.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +639 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +639 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Qhttps://vulners.com/o...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Qhttps://vulners.com/githu...

br.com.anteros:anteros-keycloak (1.0.0), com.blossom-project:blossom-starter-ui-api (>=1.0.0.m2, <=1.1.1) +47 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =1.0.6, =1.0.0, =0.7.4, =0.7.8 - com.vmware.card-connectors:airwatch-connector 2.1 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...