Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spri

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dell

Description

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Pivotal Spring Security OAuth

  • 2.0.0 to 2.0.9affected
  • 1.0.0 to 1.0.5affected

References