Code injection in Pivotal Spring Security OAuth
Priority MEDIUM 55CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
Why it matters now
EPSS 0.10616 95th percentileScored 2026-11-07
Fix Partial org.springframework.security.oauth:spring-security-oauth2 (Maven): 2.3.3, 2.2.2, 2.1.2 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pivotal | Spring Security OAuth | 2.3 prior to 2.3.3; 2.2 prior to 2.2.2; 2.1 prior to 2.1.2; 2.0 prior to 2.0.15 | — | No fix listed | CNA |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.3.0 to before 2.3.3 | 2.3.3 | Patch available | GHSA-rrpm-pj7p-7j9q |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.2.0 to before 2.2.2 | 2.2.2 | Patch available | GHSA-rrpm-pj7p-7j9q |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-rrpm-pj7p-7j9q |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.0.0 to before 2.0.15 | 2.0.15 | Patch available | GHSA-rrpm-pj7p-7j9q |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 1.0.0 – 1.0.5 | — | No fix listed | GHSA-rrpm-pj7p-7j9q |
- Spring Security OAuth VendorPivotal Affected 2.3 prior to 2.3.3; 2.2 prior to 2.2.2; 2.1 prior to 2.1.2; 2.0 prior to 2.0.15 Fixed in — No fix listed CNA
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.3.0 to before 2.3.3 Fixed in 2.3.3 Patch available GHSA-rrpm-pj7p-7j9q
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.2.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-rrpm-pj7p-7j9q
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-rrpm-pj7p-7j9q
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.0.0 to before 2.0.15 Fixed in 2.0.15 Patch available GHSA-rrpm-pj7p-7j9q
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 1.0.0 – 1.0.5 Fixed in — No fix listed GHSA-rrpm-pj7p-7j9q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_security_oauth:*:*:*:*:*:*:*:* | up to 2.0.14; 2.1 – 2.1.1; 2.2 – 2.2.1; 2.3 – 2.3.2 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:pivotal_software:spring_security_oauth:*:*:*:*:*:*:*:* Versions up to 2.0.14; 2.1 – 2.1.1; 2.2 – 2.2.1; 2.3 – 2.3.2 Vulnerable ·Spring by Pivotal
Remediation
- Fix · GHSA-rrpm-pj7p-7j9q org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.3.3 Advisory →
- Fix · GHSA-rrpm-pj7p-7j9q org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.2.2 Advisory →
- Fix · GHSA-rrpm-pj7p-7j9q org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.1.2 Advisory →
- Fix · GHSA-rrpm-pj7p-7j9q org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.0.15 Advisory →
Red Hat 2 advisories
- RHSA-2018:2939 Released 2018-10-17 · Red Hat rating CriticalRed Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8
- RHSA-2018:1809 Released 2018-06-07 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Spring Boot security and bug fix update
- Text-Only RHOAR
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8 | Fixed | RHSA-2018:2939 |
| Text-Only RHOAR | Fixed | RHSA-2018:1809 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1260
- 2026-10-03 Alias added: GHSA-rrpm-pj7p-7j9q
References
Advisory 5
More Pivotal vulnerabilities
- TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
- TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
- TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
- TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
- TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
- TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-1260 · CVE Program
- CVE-2018-1260 · NVD
- FIRST EPSS
- GHSA-rrpm-pj7p-7j9q · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1260 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences