CVE-2018-15801low

CVE-2018-15801: falha de baixa gravidade em Spring Security

Authorization Bypass During JWT Issuer Validation with spring-security

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Security+ Monitorar org.springframework.security:spring-security-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.3epss 0.7%
Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Spring by Pivotal · Spring Security