PT-2018-13216 · Spring · Spring Security

Björn Bilger · Published 2018-12-19 · Updated 2022-06-03 · CVE-2018-15801

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.1.x prior to 5.1.2

Description The issue allows for an authorization bypass during JWT issuer validation. This can occur when the same private key is used for both an honest issuer and a malicious user to sign JWTs. In such a scenario, a malicious user could create signed JWTs with a malicious issuer URL, potentially allowing them to be granted access as if they were from the honest issuer.

Recommendations For Spring Security versions 5.1.x prior to 5.1.2, update to version 5.1.2 or later to resolve the authorization bypass vulnerability.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2018-15801

GHSA-27XW-P8V6-9JJR

Affected Products

Spring Security

References · 8

• https://osv.dev/vulnerability/GHSA-27xw-p8v6-9jjr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15801 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15801 · Vendor Advisory
• https://pivotal.io/security/cve-2018-15801 · Vendor Advisory
• https://github.com/spring-projects/spring-security · Note
• https://github.com/spring-projects/spring-security/commit/c70b65c5df0e170a2d34d812b83db0b7bc71ea25 · Note
• https://t.me/cvenotify/28604 · Telegram Post
• https://github.com/advisories/GHSA-27xw-p8v6-9jjr · Note