Skip to content
Fencer Intel
high 8.8

CVE-2016-4977 in the critical feed json

Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views

published 2017-05-25 9 y ago modified 2026-06-17 4 mo ago also GHSA-7q9c-h23x-65fq , EUVD-2018-0540

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
79.2%
EPSS 79.2% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known, plus a Nuclei check

Summary

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

Patch / fix

  • maven org.springframework.security.oauth:spring-security-oauth2 1.0.5, 2.0.10

Exploit prediction

79.18% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Nuclei template Spring Security OAuth2 Remote Command Execution nuclei detection template

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.springframework.security.oauth:spring-security-oauth2
>=2.0.0, <2.0.10
>=1.0.0, <1.0.5
2.0.10
1.0.5

Affected products

  • Pivotal Spring Security OAuth

Classification

Weakness
  • CWE-19 Data Processing Errors
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.