CVE-2018-1260
critical · 9.8Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
9.8
CVSS
10.6%
EPSS (exploit prob.)
96th
EPSS percentile
2018-05-11
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| pivotal_software | spring_security_oauth | <= 2.0.14 |
| pivotal_software | spring_security_oauth | >= 2.1, <= 2.1.1 |
| pivotal_software | spring_security_oauth | >= 2.2, <= 2.2.1 |
| pivotal_software | spring_security_oauth | >= 2.3, <= 2.3.2 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/104158
- https://access.redhat.com/errata/RHSA-2018:1809
- https://access.redhat.com/errata/RHSA-2018:2939
- https://pivotal.io/security/cve-2018-1260
- http://www.securityfocus.com/bid/104158
- https://access.redhat.com/errata/RHSA-2018:1809
- https://access.redhat.com/errata/RHSA-2018:2939
- https://pivotal.io/security/cve-2018-1260
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-1260