The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsUpgrade org.springframework.security:spring-security-oauth2-client
to version 5.4.11, 5.6.9, 5.7.5 or higher.
Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token
response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.
This vulnerability exposes applications that meet all of the following requirements:
Act in the role of a Login Client (e.g. http.oauth2Login()
)
Use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")
) in the client application
Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])
This vulnerability does not expose applications that:
Act in the role of a Resource Server only (e.g. http.oauth2ResourceServer()
)
Use authorization rules with authorities not mapped from authorized scopes (e.g. anyRequest().hasAuthority("ROLE_USER")
) in the client application