CVE-2019-11269

描述

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

如何修補 CVE-2019-11269

要修補 CVE-2019-11269,請將受影響套件升級到下列已修補版本。

• —升級至 2.0.18.RELEASE 或更新版本

CVE-2019-11269 正在被利用嗎?

中等 — EPSS 為 8.9%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 2.0.0.RELEASE, < 2.0.18.RELEASE

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-11269
• WEBpacketstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html
• WEBpivotal.io/security/cve-2019-11269
• WEBwww.oracle.com/security-alerts/cpujan2021.html