PT-2018-11252 · Spring · Spring Cloud Sso Connector

Publicado 2018-05-07 · Atualizado 2022-05-13 · CVE-2018-1256

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Cloud SSO Connector version 2.1.2

Description The issue is related to a regression in the Spring Cloud SSO Connector that disables issuer validation in resource servers not bound to the SSO service. This allows a remote attacker to authenticate to unbound resource servers using tokens generated from another service plan in PCF deployments with multiple SSO service plans.

Recommendations For Spring Cloud SSO Connector version 2.1.2, update to version 2.1.3 to resolve the issue. Alternatively, bind your resource server to the SSO service plan via a service instance binding. Alternatively, set sso.connector.cloud.available=true within your Spring application properties.

Correção

Identificadores relacionados

CVE-2018-1256

GHSA-Q4Q2-93PW-QWGF

Produtos afetados

Spring Cloud Sso Connector

Referências · 5

• https://github.com/pivotal-cf/spring-cloud-sso-connector/commit/ef647a2acf2363c6018e8543d665ac8862593372 · Nota
• https://pivotal.io/security/cve-2018-1256 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1256 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1256 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-q4q2-93pw-qwgf · Aviso do Fabricante