Aller au contenu
Se connecter
6.1 Moyenne

CVE-2024-22258 Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are…

Description

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring 1.2 1.2.x → < 1.2.3 1.2.3
Spring 1.1 1.1.x → < 1.1.6 1.1.6
Spring 1.0 1.0.x → < 1.0.6 1.0.6

Autres CVE de Spring

Les 4 CVE de Spring →
CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack 5.3 Moyenne CVE-2024-38821 Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under… 9.1 Critique CVE-2024-38816 Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to… 7.5 Élevée
Suivre cette CVE