CVE-2018-1256

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service

published May 7, 2018

CVSS
—
EPSS
2%
Percentile
75.1
In the wild
Unconfirmed
What it is

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01578 · 75.1th percentile
Published
2018-05-07T15:00Z
EPSS history
Timeline
  • 07 MAY 15:00Z
    Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service
    cvelistv5