PT-2019-2963

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.2.x up to 4.2.12 Description The issue is related to the implementation of the PlaintextPasswordEncoder class in the Spring Security Java framework, which is used to secure industrial applications. It is associated...

PlaintextPasswordEncoder authenticates encoded passwords that are null

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

Security Bulletin: Remote code execution vulnerability (CVE-2019-3778) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability CVE-2019-3778. Vulnerability Details CVE-ID: CVE-2019-3778 Description: Spring Security OAuth could allow a remote attacker t...

Spring Security OAuth - Open Redirector Vulnerability

Exploit for java platform in category web applications Exploit Title: Open Redirector in spring-security-oauth2 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link: https://spring.io Version: Spring Security OAuth versions 2.3 prior to 2.3.6...

Spring Security OAuth 2.3 Open Redirection

Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link: https://spring.io Version: Spring Security OAuth versions 2.3 prior to 2.3.6...

Spring Security OAuth - Open Redirector

Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link: https://spring.io Version: Spring Security OAuth versions 2.3 prior to 2.3.6...

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-11269 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.17.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =1.4.0, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-11269 Source advisory: GHSA-MMF6-6597-3V6M...

uk.ac.ox.it.lti:lti-launch (>=1.5.0, <=1.6.0) potentially affected by CVE-2019-11269 via org.springframework.security.oauth:spring-security-oauth (2.3.5.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version 2.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth and may be impacted: - uk.ac.ox.it.lti:lti-launch =1.5.0, =1.6...

Open Redirect in Spring Security OAuth

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

GHSA-MMF6-6597-3V6M Open Redirect in Spring Security OAuth

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

uk.ac.ox.it.lti:lti-launch (>=1.5.0, <=1.6.0) potentially affected by CVE-2019-11269 via org.springframework.security.oauth:spring-security-oauth (2.3.5.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version 2.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth and may be impacted: - uk.ac.ox.it.lti:lti-launch =1.5.0, =1.6...

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-11269 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.17.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =1.4.0, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-11269 Source advisory:...

Authorization

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

CVE-2019-11269

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

CVE-2019-11269

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

CVE-2019-11269

CVE-2019-11269 affects Spring Security OAuth; an open-redirect at the authorization endpoint (redirect_uri) can leak the authorization code. Affected versions: 2.3 before 2.3.6, 2.2 before 2.2.5, 2.1 before 2.1.5, 2.0 before 2.0.18, and older unsupported versions. Attack requires a crafted reques...

CVE-2019-11269 Open Redirector in spring-security-oauth2

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

CVE-2019-11269

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the...

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-11269 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.17.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =1.4.0, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-11269 Source advisory: MEND:CVE-2019-11269...

uk.ac.ox.it.lti:lti-launch (>=1.5.0, <=1.6.0) potentially affected by CVE-2019-11269 via org.springframework.security.oauth:spring-security-oauth (2.3.5.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version 2.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth and may be impacted: - uk.ac.ox.it.lti:lti-launch =1.5.0, =1.6...