VDB
CVE-2024-22258
CVE-2024-22258
PUBLISHED
CVSS 6.099999904632568 MEDIUM
Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.
EPSS 0.52% · 41.5th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.52%
41.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Spring | N/A | |
| Spring | Spring | 1.1.x, 1.2.x , 1.0.x |
| Maven | org.springframework.security:spring-security-oauth2-authorization-server | 0, 0, 1.2.0 |
Timeline
- Mar 20, 2024 CVE Published
- Mar 20, 2024 EPSS Score
- Apr 15, 2024 EPSS Score
- May 11, 2024 EPSS Score
- Jun 6, 2024 EPSS Score
- Jul 2, 2024 EPSS Score
- Jul 27, 2024 EPSS Score
- Aug 22, 2024 EPSS Score
- Sep 17, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 13, 2024 EPSS Score
- Nov 8, 2024 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-22258 advisory
- https://github.com/spring-projects/spring-authorization-server/commit/a7035d22bd2de6c24e7125623d38fb83d8f659a9 url
- https://spring.io/security/cve-2024-22258 url
- github.com/spring-projects/spring-authorization-server package
- https://spring.io/security/cve-2024-22258/ advisory