CVE-2016-4977-POC

This repository does not have a README...

cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

CVE-2016-4977

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 are vulnerable to remote code execution (RCE) . The root cause is that the response_type parameter value is executed as Spring SpEL when processing authorization requests using whitelabel views . A malicious user can craft this para...

CVE-2 0 1 6-4 9 7 7: RCE in Spring Security Oauth vulnerability analysis-vulnerability warning-the black bar safety net

Version affected Pivotal Spring Security OAuth 2.0 – 2.0.9 Pivotal Spring Security OAuth 1.0 – 1.0.5 Background A few months ago, I for one use Spring Security OAuth framework for authorization of the Web application were tested. In my research, I discovered some issues, including remote code...