CVE-2024-22258

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22258
Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://spring.io/security/cve-2024-22258
https://spring.io/security/cve-2024-22258
Configurations

No configuration.

History

05 Dec 2024, 21:15

Type Values Removed Values Added
CWE CWE-470

21 Nov 2024, 08:55

Type Values Removed Values Added
References () https://spring.io/security/cve-2024-22258 - () https://spring.io/security/cve-2024-22258 -
Summary
  • (es) Las versiones 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 y versiones anteriores no compatibles de Spring Authorization Server son susceptibles a un ataque de degradación de PKCE para clientes confidenciales. En concreto, una aplicación es vulnerable cuando un cliente confidencial utiliza PKCE para la concesión del código de autorización. Una aplicación no es vulnerable cuando un cliente público utiliza PKCE para la concesión del código de autorización.

20 Mar 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-20 04:15

Updated : 2024-12-05 21:15

NVD link : CVE-2024-22258

Mitre link : CVE-2024-22258

CVE.ORG link : CVE-2024-22258

JSON object : View

Products Affected

No product.

CWE
CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')