org.springframework.security:spring-security-oauth2-client 5.1.5.RELEASE vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-oauth2-client package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Authorization Bypass Affected versions of this package are vulnerable to Authorization Bypass due to the use of `String.toLowerCase()` and `String.toUpperCase()` that have `Locale` dependent exceptions, which results in authorization rules not working properly. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-oauth2-client` to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.	[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)
H Privilege Escalation Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an `OAuth2 Access Token` response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token. This vulnerability exposes applications that meet all of the following requirements: Act in the role of a Login Client (e.g. `http.oauth2Login()`) Use one or more authorization rules with authorities mapped from authorized scopes (e.g. `anyRequest().hasAuthority("SCOPE_message.write")`) in the client application Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1]) This vulnerability does not* expose applications that:* Act in the role of a Resource Server only (e.g. `http.oauth2ResourceServer()`) Use authorization rules with authorities not mapped from authorized scopes (e.g. `anyRequest().hasAuthority("ROLE_USER")`) in the client application How to fix Privilege Escalation? Upgrade `org.springframework.security:spring-security-oauth2-client` to version 5.4.11, 5.6.9, 5.7.5 or higher.	[,5.4.11)[5.6.0,5.6.9)[5.7.0,5.7.5)

Vulnerability

Vulnerable Version

Authorization Bypass

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-oauth2-client to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

Privilege Escalation

Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.

This vulnerability exposes applications that meet all of the following requirements:

Act in the role of a Login Client (e.g. http.oauth2Login())
Use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")) in the client application
Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])

This vulnerability does not expose applications that:

Act in the role of a Resource Server only (e.g. http.oauth2ResourceServer())
Use authorization rules with authorities not mapped from authorized scopes (e.g. anyRequest().hasAuthority("ROLE_USER")) in the client application

How to fix Privilege Escalation?

Upgrade org.springframework.security:spring-security-oauth2-client to version 5.4.11, 5.6.9, 5.7.5 or higher.

[,5.4.11)[5.6.0,5.6.9)[5.7.0,5.7.5)

org.springframework.security:spring-security-oauth2-client@5.1.5.RELEASE vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?