CVE-2016-4977

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-4977
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4977.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-4977
Aliases
Published
2017-05-25T17:29:00.707Z
Modified
2026-05-18T10:52:03.686418Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype.

References

Affected packages

Git / github.com/spring-attic/spring-security-oauth

Affected ranges

Type
GIT
Repo
https://github.com/spring-attic/spring-security-oauth
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2d6640db09f3c3b7612ec3bf08e7ff8ff2b90cc7
Last affected
d648f056015c5a43e1f8f198180290a0721ef234
Last affected
cdf933e8ed1dddbfb5002b44917817c8a3a856ec
Last affected
7838c880ff8a58525095ebcbee1f7be6206c8f3e
Last affected
bbe9c54e336facd91db235718fafab8433bcf02b
Last affected
be52453f005b9f46532f7de5e30744784370522c
Last affected
e5f9ff3be7d9cf1101d96aa3e169e34f33421516
Last affected
15ae2a0a908352c123e7eb267e16e07af73f7951
Last affected
3249391c7c51ff93d48032f10baccba8163b4611
Last affected
691ffb197b25bd1ef93621f541fd87462557e1a5
Last affected
84cc3b3e25cc3d693be3bafc0a03ed669654ad2c
Last affected
1d2547f3dfeba5c249060ffc413b157603f022aa
Last affected
b38b3719b9b09fac39ad0d7a83dbad3a48ee1ca4
Last affected
9bbf9c605d37261fa1df039b6b34026340aaecb7
Last affected
37ed413a4c1cd14018b43156c4f76bbb9f9fd3c6
Last affected
8c9e8ec70eb50542ed86fd4e1d110137e6e8e96b
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": [
        "cpe:2.3:a:pivotal:spring_security_oauth:1.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:1.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:1.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:1.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:1.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:1.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:pivotal:spring_security_oauth:2.0.9:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "last_affected": "1.0.3"
        },
        {
            "last_affected": "1.0.4"
        },
        {
            "last_affected": "1.0.5"
        },
        {
            "last_affected": "2.0.0"
        },
        {
            "last_affected": "2.0.1"
        },
        {
            "last_affected": "2.0.2"
        },
        {
            "last_affected": "2.0.3"
        },
        {
            "last_affected": "2.0.4"
        },
        {
            "last_affected": "2.0.5"
        },
        {
            "last_affected": "2.0.6"
        },
        {
            "last_affected": "2.0.7"
        },
        {
            "last_affected": "2.0.8"
        },
        {
            "last_affected": "2.0.9"
        }
    ]
}

Affected versions

1.*
1.0.0.M5
1.0.0.M6
1.0.0.M6a
1.0.0.M6b
1.0.0.M6d
1.0.0.RC1
1.0.0.RC2
1.0.0.RC3
1.0.0.RELEASE
1.0.1.RELEASE
1.0.2.RELEASE
1.0.3.RELEASE
1.0.4.RELEASE
1.0.5.RELEASE
2.*
2.0.0.M2
2.0.0.M3
2.0.0.M4
2.0.0.RC1
2.0.0.RC2
2.0.0.RELEASE
2.0.1.RELEASE
2.0.2.RELEASE
2.0.3.RELEASE
2.0.4.RELEASE
2.0.5.RELEASE
2.0.6.RELEASE
2.0.7.RELEASE
2.0.8.RELEASE
2.0.9.RELEASE
jwt1.*
jwt1.0.1.RELEASE

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4977.json"