CVE-2019-11269: Open Redirector in spring-security-oauth2
Spring Security OAuth could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using redirecturi parameter in a specially-crafted URL to redirect a victim to arbitrary Web sites.
Other sources
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirecturi parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this security vulnerability?
The vulnerability ID of this security vulnerability is CVE-2019-11269.
What is the severity of CVE-2019-11269?
CVE-2019-11269 has a severity score of 7.4, which is considered high.
What is the affected software for CVE-2019-11269?
The affected software for CVE-2019-11269 includes Spring Security OAuth versions 2.0 to 2.0.18, 2.1 to 2.1.5, 2.2 to 2.2.5, and 2.3 to 2.3.6, as well as older unsupported versions.
How can a remote attacker exploit CVE-2019-11269?
A remote attacker can exploit CVE-2019-11269 through an open redirector attack, which can leak an authorization code and potentially lead to phishing attacks.
Are there any references for CVE-2019-11269?
Yes, you can find more information about CVE-2019-11269 at the following references: [Reference 1](http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html), [Reference 2](https://pivotal.io/security/cve-2019-11269), and [Reference 3](https://www.oracle.com/security-alerts/cpujan2021.html).