spring-security-oauth2-client vulnerable to Privilege Escalation
High severity
GitHub Reviewed
Published
Nov 1, 2022
to the GitHub Advisory Database
•
Updated Jan 31, 2023
Package
Affected versions
>= 5.7.0, < 5.7.5
< 5.6.9
Patched versions
5.7.5
5.6.9
Description
Published by the National Vulnerability Database
Oct 31, 2022
Published to the GitHub Advisory Database
Nov 1, 2022
Reviewed
Nov 1, 2022
Last updated
Jan 31, 2023
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.
References