Main Vulnerability Database Vulnerabilities #VU18660

Insufficient verification of data authenticity in Spring Security OAuth - CVE-2019-11269

Published: June 3, 2019 / Updated: June 17, 2021

Vulnerability identifier: #VU18660

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11269

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to the application relies on the URL passed via the "redirect_uri" parameter. A remote attacker can create a specially crafted link that once clicked will cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker after successful authentication. As a result the attacker can gain authorization code and bypass OAuth authentication.

Affected software

Spring Security OAuth
Oracle Banking Liquidity Management
Oracle Banking Virtual Account Management
Oracle Banking Corporate Lending Process Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Trade Finance Process Management
Oracle Banking Supply Chain Finance
Oracle FLEXCUBE Universal Banking
Oracle Banking Payments

How to mitigate CVE-2019-11269

Install updates from vendor's website.

Spring Security OAuth - addressed in versions 2.0.18, 2.1.5, 2.2.5, 2.3.6

Links to Public Exploits and PoC-codes

Exploit #5919 - Spring Security OAuth - Open Redirector (June 17, 2021)

External References

https://pivotal.io/security/cve-2019-11269