CVE-2024-22258 - Vulnerability Details - OpenCVE

ReportizFlow

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://spring.io/security/cve-2024-22258

History

Thu, 05 Dec 2024 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-470

Wed, 20 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-03-20T03:58:13.125Z

Updated: 2024-12-05T20:31:25.882Z

Reserved: 2024-01-08T18:43:15.943Z

Link: CVE-2024-22258

Vulnrichment

Updated: 2024-08-01T22:43:33.663Z

NVD

Status : Awaiting Analysis

Published: 2024-03-20T04:15:08.600

Modified: 2024-12-05T21:15:07.530

Link: CVE-2024-22258

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22258", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:15.943Z", "datePublished": "2024-03-20T03:58:13.125Z", "dateUpdated": "2024-12-05T20:31:25.882Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "packageName": "Spring Authorization Server", "product": "Spring", "vendor": "Spring", "versions": [{"lessThan": "1.0.6", "status": "affected", "version": "1.0.x", "versionType": "enterprise support only"}, {"lessThan": "1.1.6", "status": "affected", "version": "1.1.x", "versionType": "oss"}, {"lessThan": "1.2.3", "status": "affected", "version": "1.2.x\t", "versionType": "oss"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.</p><p>Specifically, an application is vulnerable when a <strong>Confidential Client</strong> uses PKCE for the Authorization Code Grant.</p><p>An application is not vulnerable when a <strong>Public Client</strong> uses PKCE for the Authorization Code Grant.</p><br>"}], "value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client\u00a0uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client\u00a0uses PKCE for the Authorization Code Grant.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-03-20T03:58:15.047Z"}, "references": [{"url": "https://spring.io/security/cve-2024-22258"}], "source": {"discovery": "UNKNOWN"}, "title": "CVE-2024-22258: PKCE Downgrade in Spring Authorization Server", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.663Z"}, "title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2024-22258", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-470", "lang": "en", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T19:20:26.714356Z", "id": "CVE-2024-22258", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T20:31:25.882Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2024-22258", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.663Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22258", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T19:20:26.714356Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-470", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T19:20:31.997Z"}}], "cna": {"title": "CVE-2024-22258: PKCE Downgrade in Spring Authorization Server", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring", "versions": [{"status": "affected", "version": "1.0.x", "lessThan": "1.0.6", "versionType": "enterprise support only"}, {"status": "affected", "version": "1.1.x", "lessThan": "1.1.6", "versionType": "oss"}, {"status": "affected", "version": "1.2.x\t", "lessThan": "1.2.3", "versionType": "oss"}], "packageName": "Spring Authorization Server", "defaultStatus": "affected"}], "references": [{"url": "https://spring.io/security/cve-2024-22258"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client\u00a0uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client\u00a0uses PKCE for the Authorization Code Grant.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.</p><p>Specifically, an application is vulnerable when a <strong>Confidential Client</strong> uses PKCE for the Authorization Code Grant.</p><p>An application is not vulnerable when a <strong>Public Client</strong> uses PKCE for the Authorization Code Grant.</p><br>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-03-20T03:58:15.047Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22258", "state": "PUBLISHED", "dateUpdated": "2024-12-05T20:31:25.882Z", "dateReserved": "2024-01-08T18:43:15.943Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-03-20T03:58:13.125Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}