https://bugzilla.redhat.com/show_bug.cgi?id=1305443
Bug ID: 1305443
Summary: CVE-2015-5258 springframework-social: CSRF
vulnerability when authorizing an app against OAuth 2
API provider
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
It was found that when authorizing an application against an OAuth 2 API
provider, Spring Social is vulnerable to a Cross-Site Request Forgery (CSRF)
attack. The attack involves a malicious user beginning an OAuth 2 authorization
flow using a fake account with an OAuth 2 API provider, but completing it by
tricking the victim into visiting the callback request in their browser. As a
consequence, the attacker will have access to the victim's account on the
vulnerable site by way of the fake provider account.
External Reference:
https://blog.srcclr.com/spring-social-core-vulnerability-disclosure/
--
You are receiving this mail because:
You are on the CC list for the bug.