org.springframework.social:spring-social-core@1.1.1.RELEASE vulnerabilities
latest version
1.1.6.RELEASE
latest non vulnerable version
first published
13 years ago
latest version published
6 years ago
licenses detected
- [1.0.0.RELEASE,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.springframework.social:spring-social-core package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.springframework.social:spring-social-core is an extension of the Spring Framework that allows you to connect your applications with Software-as-a-Service (SaaS) API providers such as Facebook, Twitter, and LinkedIn. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). It was found that when authorizing an application against an OAuth 2 API provider, Spring Social is vulnerable to a Cross-site Request Forgery (CSRF) attack. The attack involves a malicious user beginning an OAuth 2 authorization flow using a fake account with an OAuth 2 API provider, but completing it by tricking the victim into visiting the callback request in their browser. As a consequence, the attacker will have access to the victim's account on the vulnerable site by way of the fake provider account. How to fix Cross-site Request Forgery (CSRF)? Upgrade | [1.0.0.RELEASE,1.1.3.RELEASE) |