Detections
Analytics

SCA: security update for org.springframework.security.oauth:spring-security-oauth, org.springframework.security.oauth:spring-security-oauth2 (GHSA-77rv-6vfw-x4gc)

medium Tenable Self-Hosted Container Security Plugin ID 422062

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and
 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that
 can leak an authorization code. A malicious user or attacker can craft a request to the authorization
 endpoint using the authorization code grant type, and specify a manipulated redirection URI via the
 "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-
 agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability
 exposes applications that meet all of the following requirements: Act in the role of an Authorization
 Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the
 AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an
 Authorization Server and uses a different RedirectResolver implementation other than
 DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in
 the role of a Client only (e.g. @EnableOAuthClient). (CVE-2019-3778)

See Also

https://github.com/advisories/GHSA-77rv-6vfw-x4gc

Plugin Details

Severity: Medium

ID: 422062

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 56.93

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2019-3778

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/14/2019

Vulnerability Publication Date: 2/21/2019

Reference Information

CVE: CVE-2019-3778

BID: 107153

cwe: CWE-601