Privilege Escalation in spring-security-oauth2
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.
Summary
Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pivotal | Spring Security OAuth | 2.3 – 2.3.3; 2.2 – 2.2.2; 2.1 – 2.1.2; 2.0 – 2.0.15 | — | No fix listed | CNA |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.0.0 to before 2.0.16 | 2.0.16 | Patch available | GHSA-h8w4-qv99-f7vj |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.1.0 to before 2.1.3 | 2.1.3 | Patch available | GHSA-h8w4-qv99-f7vj |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.2.0 to before 2.2.3.RELEASE | 2.2.3.RELEASE | Patch available | GHSA-h8w4-qv99-f7vj |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.3.0 to before 2.3.4.RELEASE | 2.3.4.RELEASE | Patch available | GHSA-h8w4-qv99-f7vj |
- Spring Security OAuth VendorPivotal Affected 2.3 – 2.3.3; 2.2 – 2.2.2; 2.1 – 2.1.2; 2.0 – 2.0.15 Fixed in — No fix listed CNA
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-h8w4-qv99-f7vj
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.1.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-h8w4-qv99-f7vj
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.2.0 to before 2.2.3.RELEASE Fixed in 2.2.3.RELEASE Patch available GHSA-h8w4-qv99-f7vj
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.3.0 to before 2.3.4.RELEASE Fixed in 2.3.4.RELEASE Patch available GHSA-h8w4-qv99-f7vj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_security_oauth:*:*:*:*:*:*:*:* | up to 1.0.5; 2.0.0 to before 2.0.16; 2.1.0 to before 2.1.3; 2.2.0 to before 2.2.3; 2.3.0 to before 2.3.4 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:pivotal_software:spring_security_oauth:*:*:*:*:*:*:*:* Versions up to 1.0.5; 2.0.0 to before 2.0.16; 2.1.0 to before 2.1.3; 2.2.0 to before 2.2.3; 2.3.0 to before 2.3.4 Vulnerable ·Spring by Pivotal
Remediation
- Fix · GHSA-h8w4-qv99-f7vj org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.0.16 Advisory →
- Fix · GHSA-h8w4-qv99-f7vj org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.1.3 Advisory →
- Fix · GHSA-h8w4-qv99-f7vj org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.2.3.RELEASE Advisory →
- Fix · GHSA-h8w4-qv99-f7vj org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.3.4.RELEASE Advisory →
Red Hat 1 advisory
- RHSA-2019:2413 Released 2019-08-08 · Red Hat rating ImportantRed Hat Fuse 7.4.0 security update
- Red Hat Fuse 7.4.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7.4.0 | Fixed | RHSA-2019:2413 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-15758
- 2026-10-03 Alias added: GHSA-h8w4-qv99-f7vj
References
Advisory 4
Other 4
- https://github.com/spring-attic/spring-security-oauth/commit/4082ec7ae3d39198a47b5c803ccb20dacefb0b0
- https://github.com/spring-attic/spring-security-oauth/commit/623776689fdcc8047f5a908c71f348e1f172a97
- https://github.com/spring-attic/spring-security-oauth/commit/ddd65cd9417ae1e4a69e4193a622300db38e2ef
- https://github.com/spring-attic/spring-security-oauth/commit/f92223afc71687bd3156298054903f50aa71fbf
More Pivotal vulnerabilities
- TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
- TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
- TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
- TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
- TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
- TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-15758 · CVE Program
- CVE-2018-15758 · NVD
- FIRST EPSS
- GHSA-h8w4-qv99-f7vj · GitHub Advisory Database · CC BY 4.0
- CVE-2018-15758 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences