Authorization Bypass

2018-12-1902:08:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

50.0%

JSON

spring-security-oauth2-jose is vulnerable to authorization bypass attacks. The vulnerability exists during JWT issuer validation, and is only affected if the same private key for the issuer and the attacker are used when signing JWTs.

CPENameOperatorVersion
spring-security-oauth2-josele5.1.1.RELEASE
spring-security-oauth2-josele5.1.1.RELEASE

CPE	Name	Operator	Version
	spring-security-oauth2-jose	le	5.1.1.RELEASE
	spring-security-oauth2-jose	le	5.1.1.RELEASE

References

github.com/spring-projects/spring-security/compare/2bc156ed1998e0c1f9f155e90f60efb9f2069d3d...5478b74116a91421bd24e5e5f3d9be5f603d0f9e

github.com/spring-projects/spring-security/issues/6073

pivotal.io/security/cve-2018-15801

0.001 Low

EPSS

Percentile

50.0%

JSON

Related for VERACODE:8047