mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
48 lines
2.0 KiB
JSON
48 lines
2.0 KiB
JSON
{
|
|
"id": "CVE-2024-22258",
|
|
"sourceIdentifier": "security@vmware.com",
|
|
"published": "2024-03-20T04:15:08.600",
|
|
"lastModified": "2024-03-20T13:00:16.367",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client\u00a0uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client\u00a0uses PKCE for the Authorization Code Grant.\n\n"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Las versiones 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 y versiones anteriores no compatibles de Spring Authorization Server son susceptibles a un ataque de degradaci\u00f3n de PKCE para clientes confidenciales. En concreto, una aplicaci\u00f3n es vulnerable cuando un cliente confidencial utiliza PKCE para la concesi\u00f3n del c\u00f3digo de autorizaci\u00f3n. Una aplicaci\u00f3n no es vulnerable cuando un cliente p\u00fablico utiliza PKCE para la concesi\u00f3n del c\u00f3digo de autorizaci\u00f3n."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "security@vmware.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 6.1,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 2.7
|
|
}
|
|
]
|
|
},
|
|
"references": [
|
|
{
|
|
"url": "https://spring.io/security/cve-2024-22258",
|
|
"source": "security@vmware.com"
|
|
}
|
|
]
|
|
} |