CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

Published: May 25, 2017
Updated: Nov 8, 2023
CVE: CVE-2016-4977
GHSA: GHSA-7q9c-h23x-65fq
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

CWE-19

Affected Software
References

Software	From	Fixed in
pivotal / spring_security_oauth	2.0.4	2.0.4.x
pivotal / spring_security_oauth	2.0.3	2.0.3.x
pivotal / spring_security_oauth	1.0.2	1.0.2.x
pivotal / spring_security_oauth	1.0.4	1.0.4.x
pivotal / spring_security_oauth	2.0.6	2.0.6.x
pivotal / spring_security_oauth	2.0.5	2.0.5.x
pivotal / spring_security_oauth	1.0.3	1.0.3.x
pivotal / spring_security_oauth	2.0.9	2.0.9.x
pivotal / spring_security_oauth	1.0.1	1.0.1.x
pivotal / spring_security_oauth	2.0.0	2.0.0.x
pivotal / spring_security_oauth	1.0.5	1.0.5.x
pivotal / spring_security_oauth	2.0.2	2.0.2.x
pivotal / spring_security_oauth	2.0.8	2.0.8.x
pivotal / spring_security_oauth	2.0.7	2.0.7.x
pivotal / spring_security_oauth	2.0.1	2.0.1.x
pivotal / spring_security_oauth	1.0.0	1.0.0.x
org.springframework.security.oauth / spring-security-oauth2	-	2.0.10

Vulnerability Database

289,697

CVE-2016-4977