CVE-2018-1260
CRITICAL 9.8EPSS 10.8%
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
- Affected
- Pivotal · Spring Security OAuth
- CVSS v3.0 NVD
- 9.8 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 10.81% chance of exploitation in the next 30 days, 96th percentile
- Published
- 2018-05-11
- Updated
- 2024-09-17
Proof-of-concept exploits (1)
Security advisories
- https://pivotal.io/security/cve-2018-1260
- http://www.securityfocus.com/bid/104158
- https://access.redhat.com/errata/RHSA-2018:1809
- https://access.redhat.com/errata/RHSA-2018:2939
- advisories/GHSA-rrpm-pj7p-7j9q