Tóm tắt nhanh
- CVE-2018-1256 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng io.pivotal.spring.cloud:spring-cloud-sso-connector, spring cloud sso connector (vmware).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.6%, cao hơn 75.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.1.3.RELEASE hoặc mới hơn.
Mô tả
Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.
Mitigation
Users of affected versions should apply the following mitigation:
- Releases that have fixed this issue include:</p><ul><li>Spring Cloud SSO Connector: 2.1.3</li></ul>
- Alternatively, you can perform <u>one</u> of the following workarounds:</p><ul><li>Bind your resource server to the SSO service plan via a service instance binding</li><li>Set “sso.connector.cloud.available=true” within your Spring application properties</li></ul>
Mô tả của NVD
Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí