CVE-2019-11269
Last modified
CVE-2019-11269 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. EPSS estimates a 8.91% chance of exploitation in the next 30 days.
Description
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Spring Security Oauth | >= 2.0.0, < 2.0.18 |
| Pivotal Software | Spring Security Oauth | >= 2.1.0, < 2.1.5 |
| Pivotal Software | Spring Security Oauth | >= 2.2.0, < 2.2.5 |
| Pivotal Software | Spring Security Oauth | >= 2.3.0, < 2.3.6 |
| Oracle | Banking Corporate Lending | 14.1.0 |
| Oracle | Banking Corporate Lending | 14.3.0 |
| Oracle | Banking Corporate Lending | 14.4.0 |
References
- http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.htmlThird Party Advisory, VDB Entry
- https://pivotal.io/security/cve-2019-11269Vendor Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
- http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.htmlThird Party Advisory, VDB Entry
- https://pivotal.io/security/cve-2019-11269Vendor Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11269?
How severe is CVE-2019-11269?
How do I fix CVE-2019-11269?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-11263Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
- CVE-2019-11264Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
- CVE-2019-11265Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
- CVE-2019-11266Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
- CVE-2019-11267Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
- CVE-2019-11268Cloud Foundry UAA version prior to 73.3.0, contain endpoints…4.3
- CVE-2019-1127A remote code execution vulnerability exists in the way that…
- CVE-2019-11270Cloud Foundry UAA versions prior to v73.4.0 contain a vulner…7.5
- CVE-2019-11271Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain…7.8
- CVE-2019-11272Spring Security, versions 4.2.x up to 4.2.12, and older unsu…7.3
- CVE-2019-11273Pivotal Container Services (PKS) versions 1.3.x prior to 1.3…4.3
- CVE-2019-11274Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable t…6.1
Are you affected by CVE-2019-11269?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST